CVE-2026-106584
published 2026-10-06CVE-2026-106584: In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more…
PriorityP411low3.3CVSS 3.1
AVLACLPRLUINSUCNILAN
EPSS
0.06%
0.0th percentile
In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openbsd | openssh | < 10.6 | 10.6 |
| openbsd | openssh | — | — |
| ubuntu | openssh | — | — |
| ubuntu | openssh-gssapi | — | — |
CVSS provenance
nvdv3.13.3LOWCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
vendor_ubuntu6.5MEDIUM
vendor_redhat3.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
OpenSSH vulnerabilities
vendor_ubuntu·2026-10-19·CVSS 6.5
CVE-2026-106553 [MEDIUM] OpenSSH vulnerabilities
Title: OpenSSH vulnerabilities
Summary: Several security issues were fixed in OpenSSH.
It was discovered that OpenSSH's sftp client incorrectly handled paths
returned by the server during a recursive copy operation. A remote attacker
controlling the server could possibly use this issue to write files to
unintended locations. (CVE-2026-106552)
It was discovered that OpenSSH's sshd server incorrectly handled
GSSAPIAuthentication state across authentication attempts. An attacker
could possibly use this issue to obtain credentials from a previous failed
authentication attempt. (CVE-2026-106553, CVE-2026-106555)
It was discovered that OpenSSH incorrectly used an LZ77 dictionary coder
during compression. An attacker could possibly use this issue to obtain
sensitive information. (CVE-2026-106
Ubuntu
OpenSSH vulnerabilities
vendor_ubuntu·2026-10-14·CVSS 6.5
CVE-2026-106552 [MEDIUM] OpenSSH vulnerabilities
Title: OpenSSH vulnerabilities
Summary: Several security issues were fixed in OpenSSH.
It was discovered that OpenSSH's sftp client incorrectly handled paths
returned by the server during a recursive copy operation. A remote
attacker controlling the server could possibly use this issue to write
files to unintended locations. (CVE-2026-106552)
It was discovered that OpenSSH's sshd server incorrectly handled
GSSAPIAuthentication state across authentication attempts. An attacker
could possibly use this issue to obtain credentials from a previous
failed authentication attempt. (CVE-2026-106553, CVE-2026-106555)
It was discovered that OpenSSH incorrectly used an LZ77 dictionary coder
during compression. An attacker could possibly use this issue to obtain
sensitive information. (CVE-2026-106
Red Hat
openssh: openssh: Incorrect certificate expiration times via Daylight Saving Time mishandling
vendor_redhat·2026-10-06·CVSS 3.3
CVE-2026-106584 [LOW] CWE-295 openssh: openssh: Incorrect certificate expiration times via Daylight Saving Time mishandling
openssh: openssh: Incorrect certificate expiration times via Daylight Saving Time mishandling
In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.
A flaw was found in OpenSSH. During certificate generation with the ssh-keygen utility, Daylight Saving Time (DST) is mishandled when converting dates. This flaw can cause certificates to be issued with incorrect expiration times, potentially allowing them to remain valid longer than intended or expire prematurely.
Statement: A flaw was found in the OpenSSH ssh-keygen utility, which is used for certificate generation and is included in Red Hat Hardened Images. When converting dates, ss
GHSA
In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling.
ghsa_unreviewed·2026-10-06
CVE-2026-106584 [LOW] CWE-193 In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling.
In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.
No detection rules found.
No public exploits indexed.
2026-10-06
Published