CVE-2026-55653
published 2026-06-23CVE-2026-55653: A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) client path. This…
PriorityP335medium6.5CVSS 3.1
AVNACLPRNUIRSUCNINAH
EPSS
0.43%
36.7th percentile
A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occurs during FIPS (Federal Information Processing Standards) mode known-group validation when the client processes attacker-controlled DH-GEX group parameters. Successful exploitation leads to client-side process termination, resulting in a Denial of Service (DoS).
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | openshift_container_platform | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
openssh: Double free in Red Hat Enterprise Linux versions of OpenSSH DH-GEX client path during FIPS known-group validation leads to client-side denial of service
vendor_redhat·2026-06-22·CVSS 4.3
CVE-2026-55653 [MEDIUM] CWE-415 openssh: Double free in Red Hat Enterprise Linux versions of OpenSSH DH-GEX client path during FIPS known-group validation leads to client-side denial of service
openssh: Double free in Red Hat Enterprise Linux versions of OpenSSH DH-GEX client path during FIPS known-group validation leads to client-side denial of service
A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occurs during FIPS (Federal Information Processing Standards) mode known-group validation when the client processes attacker-controlled DH-GEX group parameters. Successful exploitation leads to client-side process termination, resulting in a Denial of Service (DoS).
Statement: This Moderate flaw in OpenSSH affects clients operating in FIPS mode when negotiating Diffie-Hellman Group Exchange (DH-GEX) with a malicious SSH server. While it can lead to client process termination,
GHSA
A flaw was found in OpenSSH.
ghsa_unreviewed·2026-06-23
CVE-2026-55653 [MEDIUM] CWE-415 A flaw was found in OpenSSH.
A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occurs during FIPS (Federal Information Processing Standards) mode known-group validation when the client processes attacker-controlled DH-GEX group parameters. Successful exploitation leads to client-side process termination, resulting in a Denial of Service (DoS).
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-55653 openssh: Double free in Red Hat Enterprise Linux versions of OpenSSH DH-GEX client path during FIPS known-group validation leads to client-side denial of service [fedora-all]
bugzilla·2026-10-16·CVSS 6.5
CVE-2026-55653 [MEDIUM] CVE-2026-55653 openssh: Double free in Red Hat Enterprise Linux versions of OpenSSH DH-GEX client path during FIPS known-group validation leads to client-side denial of service [fedora-all]
CVE-2026-55653 openssh: Double free in Red Hat Enterprise Linux versions of OpenSSH DH-GEX client path during FIPS known-group validation leads to client-side denial of service [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
AI_ONLY_REPORT
package: openssh-9.9p1-22.el10_2
Summary: Double Free in DH-GEX Client during FIPS Mode Check: a malicious
SSH server can trigger a double free in the DH-GEX client path during FIPS
known-group validation, leading to client-side process termination in
affected configurations.
Requirements to exploit: An affected `openssh-9.9p1-22.el10_2` client build
with OpenSSL sup
Bugzilla
CVE-2026-55653 openssh: Double free in Red Hat Enterprise Linux versions of OpenSSH DH-GEX client path during FIPS known-group validation leads to client-side denial of service
bugzilla·2026-04-26
CVE-2026-55653 [MEDIUM] CVE-2026-55653 openssh: Double free in Red Hat Enterprise Linux versions of OpenSSH DH-GEX client path during FIPS known-group validation leads to client-side denial of service
CVE-2026-55653 openssh: Double free in Red Hat Enterprise Linux versions of OpenSSH DH-GEX client path during FIPS known-group validation leads to client-side denial of service
AI_ONLY_REPORT
package: openssh-9.9p1-22.el10_2
Summary: Double Free in DH-GEX Client during FIPS Mode Check: a malicious
SSH server can trigger a double free in the DH-GEX client path during FIPS
known-group validation, leading to client-side process termination in
affected configurations.
Requirements to exploit: An affected `openssh-9.9p1-22.el10_2` client build
with OpenSSL support must run in FIPS mode, negotiate
`diffie-hellman-group-exchange-sha256`, and process attacker-controlled
DH-GEX group parameters; the clearest demonstrated second-free path is a
non-fatal client flow such as `ssh-keyscan`.
Component
https://access.redhat.com/errata/RHSA-2026:36759https://access.redhat.com/errata/RHSA-2026:47755https://access.redhat.com/errata/RHSA-2026:47756https://access.redhat.com/errata/RHSA-2026:47757https://access.redhat.com/errata/RHSA-2026:54387https://access.redhat.com/errata/RHSA-2026:58981https://access.redhat.com/errata/RHSA-2026:76748https://access.redhat.com/errata/RHSA-2026:76993https://access.redhat.com/errata/RHSA-2026:80513https://access.redhat.com/errata/RHSA-2026:82749https://access.redhat.com/errata/RHSA-2026:82750https://access.redhat.com/errata/RHSA-2026:82751https://access.redhat.com/errata/RHSA-2026:82752https://access.redhat.com/errata/RHSA-2026:82753https://access.redhat.com/errata/RHSA-2026:82754https://access.redhat.com/errata/RHSA-2026:82755https://access.redhat.com/errata/RHSA-2026:82756https://access.redhat.com/errata/RHSA-2026:82757https://access.redhat.com/errata/RHSA-2026:82758https://access.redhat.com/errata/RHSA-2026:82759https://access.redhat.com/errata/RHSA-2026:82761https://access.redhat.com/errata/RHSA-2026:82762https://access.redhat.com/errata/RHSA-2026:82763https://access.redhat.com/errata/RHSA-2026:82897https://access.redhat.com/errata/RHSA-2026:82898https://access.redhat.com/errata/RHSA-2026:82899https://access.redhat.com/errata/RHSA-2026:82900https://access.redhat.com/errata/RHSA-2026:82901https://access.redhat.com/errata/RHSA-2026:82902https://access.redhat.com/errata/RHSA-2026:82903https://access.redhat.com/errata/RHSA-2026:82904https://access.redhat.com/errata/RHSA-2026:82907https://access.redhat.com/errata/RHSA-2026:82908https://access.redhat.com/errata/RHSA-2026:82909https://access.redhat.com/errata/RHSA-2026:82910https://access.redhat.com/errata/RHSA-2026:82912https://access.redhat.com/errata/RHSA-2026:82913https://access.redhat.com/errata/RHSA-2026:82914https://access.redhat.com/errata/RHSA-2026:82915https://access.redhat.com/errata/RHSA-2026:82916https://access.redhat.com/errata/RHSA-2026:82917https://access.redhat.com/errata/RHSA-2026:82918https://access.redhat.com/errata/RHSA-2026:82920https://access.redhat.com/errata/RHSA-2026:82921https://access.redhat.com/errata/RHSA-2026:82922https://access.redhat.com/errata/RHSA-2026:82923https://access.redhat.com/errata/RHSA-2026:89739https://access.redhat.com/security/cve/CVE-2026-55653https://bugzilla.redhat.com/show_bug.cgi?id=2462351
2026-06-23
Published