SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption

{
  "id": "ba99b3970ffb362baf8a4d2a9f5d376752fd4b20fe773af2d69a3b670b4e6e1a",
  "url": "https://osv.dev/vulnerability/CLEANSTART-2026-UU01575",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption",
    "summary": "CVE-2025-58181 affects multiple packages. SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption. See references for individual vulnerability details.",
    "evidence": "osv:CLEANSTART-2026-UU01575",
    "products": [
      {
        "name": {
          "value": "ollama-fips",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0.40.3-r1",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "ollama-fips",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0.40.3-r1",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "prometheus-mysqld-exporter",
          "evidence": "/affected/2/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0.20.0-r4",
            "evidence": "/affected/2/ranges"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "nfs-subdir-external-provisioner",
          "evidence": "/affected/3/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "4.0.18-r3",
            "evidence": "/affected/3/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "medium",
    "structured": {
      "id": "CLEANSTART-2026-UU01575",
      "aliases": [
        "CLEANSTART-2026-UU01575"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "0.40.3-r1"
                }
              ]
            }
          ],
          "package": {
            "name": "ollama-fips",
            "purl": "pkg:apk/cleanstart/ollama-fips?arch=x86_64",
            "ecosystem": "CleanStart"
          },
          "database_specific": {
            "source": "https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-UU01575.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "0.40.3-r1"
                }
              ]
            }
          ],
          "package": {
            "name": "ollama-fips",
            "purl": "pkg:apk/cleanstart/ollama-fips?arch=aarch64",
            "ecosystem": "CleanStart"
          },
          "database_specific": {
            "source": "https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-UU01575.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "0.20.0-r4"
                }
              ]
            }
          ],
          "package": {
            "name": "prometheus-mysqld-exporter",
            "purl": "pkg:apk/cleanstart/prometheus-mysqld-exporter",
            "ecosystem": "CleanStart"
          },
          "database_specific": {
            "source": "https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-UU01575.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "4.0.18-r3"
                }
              ]
            }
          ],
          "package": {
            "name": "nfs-subdir-external-provisioner",
            "purl": "pkg:apk/cleanstart/nfs-subdir-external-provisioner",
            "ecosystem": "CleanStart"
          },
          "database_specific": {
            "source": "https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-UU01575.json"
          }
        }
      ],
      "modified": "2026-10-15T01:00:21.994963795Z",
      "provider": "osv",
      "upstream": [
        "CVE-2025-58181"
      ],
      "references": [
        "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-UU01575.json",
        "https://osv.dev/vulnerability/CVE-2025-58181",
        "https://nvd.nist.gov/vuln/detail/CVE-2025-58181"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2025-58181",
        "evidence": "/upstream"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 318304,
  "published_at": "2026-10-15T00:41:45.045319+00:00"
}