Openbsd Openssh
136 CVEs affecting Openbsd Openssh. Latest disclosed: 2026-07-08. Critical: 6, High: 24.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-38408 | Critical | 9.8 | 2023-07-20 | The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forward… |
CVE-2023-28531 | Critical | 9.8 | 2023-03-17 | ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9. |
CVE-2016-1908 | Critical | 9.8 | 2017-04-11 | The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisio… |
CVE-2010-4478 | Critical | 9.8 | 2010-12-06 | OpenSSH 5.6 and earlier, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remote attackers to bypa… |
CVE-2002-0639 | Critical | 9.8 | 2002-07-03 | Integer overflow in sshd in OpenSSH 2.9.9 through 3.3 allows remote attackers to execute arbitrary code during challenge response authentication (ChallengeResp… |
CVE-2002-0083 | Critical | 9.8 | 2002-03-15 | Off-by-one error in the channel code of OpenSSH 2.0 through 3.0.2 allows local users or remote malicious servers to gain privileges. |
CVE-2024-6387 | High | 8.1 | 2024-07-01 | A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an uns… |
CVE-2016-0778 | High | 8.1 | 2016-01-14 | The (1) roaming_read and (2) roaming_write functions in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2, when certain proxy and forwar… |
CVE-2015-5600 | High | 8.1 | 2015-08-03 | The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processing of keyboard-interactive devices withi… |
CVE-2006-5051 | High | 8.1 | 2006-09-27 | Signal handler race condition in OpenSSH before 4.4 allows remote attackers to cause a denial of service (crash), and possibly execute arbitrary code if GSSAPI… |
CVE-2019-16905 | High | 7.8 | 2019-10-09 | OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a client or server is con… |
CVE-2016-10012 | High | 7.8 | 2017-01-05 | The shared memory manager (associated with pre-authentication compression) in sshd in OpenSSH before 7.4 does not ensure that a bounds check is enforced by all… |
CVE-2015-8325 | High | 7.8 | 2016-05-01 | The do_setup_env function in session.c in sshd in OpenSSH through 7.2p2, when the UseLogin feature is enabled and PAM is configured to read .pam_environment fi… |
CVE-2026-60002 | High | 7.7 | 2026-07-08 | ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.) |
CVE-2026-35385 | High | 7.5 | 2026-04-02 | In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is perform… |
CVE-2026-3497 | High | 7.5 | 2026-03-12 | Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux distrib… |
CVE-2020-12062 | High | 7.5 | 2020-06-01 | The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged user… |
CVE-2016-10708 | High | 7.5 | 2018-01-21 | sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYS mess… |
CVE-2016-8858 | High | 7.5 | 2016-12-09 | The kex_input_kexinit function in kex.c in OpenSSH 6.x and 7.x through 7.3 allows remote attackers to cause a denial of service (memory consumption) by sending… |
CVE-2016-6515 | High | 7.5 | 2016-08-07 | The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote atta… |