CVE-2026-73282
published 2026-08-11CVE-2026-73282: In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.
PriorityP425medium4.8CVSS 3.1
AVNACHPRNUINSUCLILAN
EPSS
0.16%
5.2th percentile
In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openbsd | openssh | < 10.5 | 10.5 |
| openbsd | openssh | — | — |
| ubuntu | openssh | — | — |
CVSS provenance
nvdv3.14.8MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
vendor_ubuntu8.1HIGH
vendor_redhat4.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
OpenSSH vulnerabilities
vendor_ubuntu·2026-09-22·CVSS 8.1
CVE-2026-73282 [HIGH] OpenSSH vulnerabilities
Title: OpenSSH vulnerabilities
Summary: Several security issues were fixed in OpenSSH.
Florian Kohnhäuser discovered that OpenSSH incorrectly handled shell
metacharacters in certain usernames. An attacker could possibly use this
issue to execute arbitrary commands when certain non-default
configurations were used, resulting in arbitrary code execution. This
issue only affected Ubuntu 14.04 LTS. (CVE-2026-35386)
Christos Papakonstantinou discovered that OpenSSH incorrectly handled
ECDSA algorithm restrictions. An attacker could possibly use this issue
to cause unintended ECDSA algorithms to be accepted, resulting in
security restrictions being bypassed. (CVE-2026-35387)
Vladimir Tokarev discovered that OpenSSH incorrectly handled certain
principal restrictions in authorized_keys files.
Ubuntu
OpenSSH vulnerabilities
vendor_ubuntu·2026-09-03·CVSS 3.5
CVE-2026-73281 [LOW] OpenSSH vulnerabilities
Title: OpenSSH vulnerabilities
Summary: Several security issues were fixed in OpenSSH.
It was discovered that OpenSSH's ssh-agent incorrectly handled interactions
between agent locking and the [email protected] extension. A remote
attacker with access to a forwarded agent connection could possibly use
this issue to perform operations that should only be available locally,
such as adding tokens or using keys. (CVE-2026-73281)
It was discovered that OpenSSH's ssh client incorrectly handled concurrent
remote-forwarding operations. A remote attacker could possibly use this
issue to cause a use-after-free condition, resulting in a denial of service
or the execution of arbitrary code. (CVE-2026-73282)
It was discovered that OpenSSH's sshd server incorrectly applied the
restrict keywor
Red Hat
openssh: OpenSSH: Information disclosure and data corruption via use-after-free in ssh client
vendor_redhat·2026-08-11·CVSS 4.8
CVE-2026-73282 [MEDIUM] CWE-825 openssh: OpenSSH: Information disclosure and data corruption via use-after-free in ssh client
openssh: OpenSSH: Information disclosure and data corruption via use-after-free in ssh client
A flaw was found in OpenSSH. A use-after-free vulnerability exists in the `ssh` client when handling concurrent remote-forwarding operations. This can occur if a remote forwarding is added via the local session multiplexing socket while a remote forwarding open request is pending with the server. A remote attacker with high attack complexity could potentially exploit this to achieve low impact on confidentiality and integrity.
Statement: A use-after-free flaw exists in OpenSSH's ssh client during concurrent remote-forwarding processing. When adding a remote forward via the local session multiplexing socket while a server remote-forward open request is pending, realloc data management fails, free
VulDB
OpenBSD OpenSSH up to 10.4 use after free (Nessus ID 344614 / WID-SEC-2026-2747)
vuldb·2026-09-11·CVSS 4.8
CVE-2026-73282 [MEDIUM] OpenBSD OpenSSH up to 10.4 use after free (Nessus ID 344614 / WID-SEC-2026-2747)
A vulnerability was found in OpenBSD OpenSSH up to 10.4 and classified as very critical. This vulnerability affects unknown code. Such manipulation leads to use after free.
This vulnerability is referenced as CVE-2026-73282. It is possible to launch the attack remotely. No exploit is available.
It is suggested to upgrade the affected component.
GHSA
In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.
ghsa_unreviewed·2026-08-11
CVE-2026-73282 [MEDIUM] CWE-416 In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.
In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-73282 openssh: OpenSSH: Information disclosure and data corruption via use-after-free in ssh client [fedora-all]
bugzilla·2026-08-17·CVSS 4.8
CVE-2026-73282 [MEDIUM] CVE-2026-73282 openssh: OpenSSH: Information disclosure and data corruption via use-after-free in ssh client [fedora-all]
CVE-2026-73282 openssh: OpenSSH: Information disclosure and data corruption via use-after-free in ssh client [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.
Bugzilla
CVE-2026-73282 openssh: OpenSSH: Information disclosure and data corruption via use-after-free in ssh client
bugzilla·2026-08-11·CVSS 4.8
CVE-2026-73282 [MEDIUM] CVE-2026-73282 openssh: OpenSSH: Information disclosure and data corruption via use-after-free in ssh client
CVE-2026-73282 openssh: OpenSSH: Information disclosure and data corruption via use-after-free in ssh client
In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.
2026-08-11
Published