RHSA-2026:82247

Vulnerability from csaf_redhat - Published: 2026-10-13 13:19 - Updated: 2026-10-20 04:11
Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Severity
Moderate
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs: openssh: * openssh-10.5p1-1.2.hum1 (aarch64, s390x, x86_64) * openssh-askpass-10.5p1-1.2.hum1 (aarch64, s390x, x86_64) * openssh-clients-10.5p1-1.2.hum1 (aarch64, s390x, x86_64) * openssh-keycat-10.5p1-1.2.hum1 (aarch64, s390x, x86_64) * openssh-keysign-10.5p1-1.2.hum1 (aarch64, s390x, x86_64) * openssh-server-10.5p1-1.2.hum1 (aarch64, s390x, x86_64) * openssh-sk-dummy-10.5p1-1.2.hum1 (aarch64, s390x, x86_64) * openssh-10.5p1-1.2.hum1.src (src)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-106552

A flaw was found in OpenSSH. A malicious or compromised server can write files to unintended locations on a client system during a recursive copy operation using the SFTP (Secure File Transfer Protocol) client. By returning crafted file paths, the remote server can trigger a directory traversal and force the client to store files outside the designated destination directory, potentially overwriting existing local files.

4.2 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@s390x —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@src —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@s390x —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@s390x —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@s390x —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@s390x —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@s390x —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64 —
Vendor Fix fix
Workaround
Threats
Impact Moderate
CVE-2026-106582

A flaw was found in OpenSSH. When session compression is enabled, an attacker with access to a shared Secure Shell (SSH) connection can exploit the compression state shared across multiplexed channels. By analyzing changes in transmitted packet lengths caused by repeated data patterns, the attacker may deduce and recover sensitive plaintext information transmitted over concurrent channels in the same session.

3.7 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-205 - Observable Behavioral Discrepancy
Affected products
Fixed 22 products, the same list as for CVE-2026-106552
Threats
Impact Low
CVE-2026-106583

A flaw was found in OpenSSH. The OpenSSH client insufficiently sanitizes command-line usernames containing special characters, such as dollar signs and backslashes. When untrusted input is passed to the client command line, an attacker can exploit this issue to perform command injection through shell-evaluated options such as ProxyCommand, potentially leading to arbitrary command execution.

2.5 (Low)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products
Fixed 22 products, the same list as for CVE-2026-106552
Threats
Impact Low
CVE-2026-106584

A flaw was found in OpenSSH. During certificate generation with the ssh-keygen utility, Daylight Saving Time (DST) is mishandled when converting dates. This flaw can cause certificates to be issued with incorrect expiration times, potentially allowing them to remain valid longer than intended or expire prematurely.

2.5 (Low)
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
CWE-295 - Improper Certificate Validation
Affected products
Fixed 22 products, the same list as for CVE-2026-106552
Threats
Impact Low
CVE-2026-106585

A flaw was found in OpenSSH. A remote attacker can trigger a denial of service (DoS) or abnormal packet processing by transmitting crafted, highly compressed data to a vulnerable client or server. The application fails to verify that decompressed payloads remain within the maximum permitted packet length limits, allowing oversized packets to be processed.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)
Affected products
Fixed 22 products, the same list as for CVE-2026-106552
Threats
Impact Moderate
CVE-2026-106586

A flaw was found in OpenSSH. In configurations where tunnel forwarding is enabled on the server, the restrict option in the authorized keys configuration fails to properly block tunnel forwarding requests. An authenticated user connecting with a restricted key can exploit this issue to bypass intended access limitations and establish unauthorized network tunnels through the server.

2.5 (Low)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
CWE-267 - Privilege Defined With Unsafe Actions
Affected products
Fixed 22 products, the same list as for CVE-2026-106552
Threats
Impact Low
CVE-2026-106587

A flaw was found in OpenSSH. When certain configuration options are set to "none" within a conditional block to disable a feature, the OpenSSH server daemon (sshd) incorrectly interprets the value as a literal file path rather than disabling the setting. A local attacker could exploit this issue by creating or manipulating a file named "none", potentially leading to improper access control enforcement or service disruption.

3.6 (Low)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
CWE-115 - Misinterpretation of Input
Affected products
Fixed 22 products, the same list as for CVE-2026-106552
Threats
Impact Low
CVE-2026-110923

A flaw was found in OpenSSH. During an sftp copy, a malicious server can supply an empty name, a slash-only path, or a ".." basename that sftp uses as the local destination, writing outside the directory the user selected.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products
Fixed 22 products, the same list as for CVE-2026-106552
Threats
Impact Moderate
CVE-2026-110925

A flaw was found in OpenSSH. A username entered on the ssh command line can still contain '$' or a non-trailing backslash. When a configuration expands %u inside ProxyCommand or Match exec, those characters are passed into the shell.

5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products
Fixed 22 products, the same list as for CVE-2026-106552
Threats
Impact Moderate
CVE-2026-110926

A flaw was found in OpenSSH. When compression is negotiated, channels on the same connection share one LZ77 dictionary. A peer who can write on one channel can recover plaintext from another channel by chosen-plaintext lengths.

5.3 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE-203 - Observable Discrepancy
Affected products
Fixed 22 products, the same list as for CVE-2026-106552
Threats
Impact Moderate
CVE-2026-110927

A flaw was found in OpenSSH. After compression is negotiated, a compressed payload can expand past the maximum supported packet size because the inflate loop does not stop at that limit. Memory use grows in the process handling that connection.

4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 22 products, the same list as for CVE-2026-106552
Threats
Impact Moderate
References
URL Category
https://access.redhat.com/errata/RHSA-2026:82247 self
https://images.redhat.com/ external
https://access.redhat.com/security/cve/CVE-2026-106586 external
https://access.redhat.com/security/updates/classi… external
https://access.redhat.com/security/cve/CVE-2026-106583 external
https://access.redhat.com/security/cve/CVE-2026-106587 external
https://access.redhat.com/security/cve/CVE-2026-106552 external
https://access.redhat.com/security/cve/CVE-2026-106582 external
https://access.redhat.com/security/cve/CVE-2026-106584 external
https://access.redhat.com/security/cve/CVE-2026-106585 external
https://access.redhat.com/security/cve/CVE-2026-110925 external
https://access.redhat.com/security/cve/CVE-2026-110926 external
https://access.redhat.com/security/cve/CVE-2026-110923 external
https://access.redhat.com/security/cve/CVE-2026-110927 external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2026-106552 self
https://bugzilla.redhat.com/show_bug.cgi?id=2547187 external
https://www.cve.org/CVERecord?id=CVE-2026-106552 external
https://nvd.nist.gov/vuln/detail/CVE-2026-106552 external
https://www.openssh.org/releasenotes.html#10.6 external
https://access.redhat.com/security/cve/CVE-2026-106582 self
https://bugzilla.redhat.com/show_bug.cgi?id=2547181 external
https://www.cve.org/CVERecord?id=CVE-2026-106582 external
https://nvd.nist.gov/vuln/detail/CVE-2026-106582 external
https://arxiv.org/abs/2609.07709 external
https://access.redhat.com/security/cve/CVE-2026-106583 self
https://bugzilla.redhat.com/show_bug.cgi?id=2547243 external
https://www.cve.org/CVERecord?id=CVE-2026-106583 external
https://nvd.nist.gov/vuln/detail/CVE-2026-106583 external
https://access.redhat.com/security/cve/CVE-2026-106584 self
https://bugzilla.redhat.com/show_bug.cgi?id=2547201 external
https://www.cve.org/CVERecord?id=CVE-2026-106584 external
https://nvd.nist.gov/vuln/detail/CVE-2026-106584 external
https://access.redhat.com/security/cve/CVE-2026-106585 self
https://bugzilla.redhat.com/show_bug.cgi?id=2547200 external
https://www.cve.org/CVERecord?id=CVE-2026-106585 external
https://nvd.nist.gov/vuln/detail/CVE-2026-106585 external
https://access.redhat.com/security/cve/CVE-2026-106586 self
https://bugzilla.redhat.com/show_bug.cgi?id=2547584 external
https://www.cve.org/CVERecord?id=CVE-2026-106586 external
https://nvd.nist.gov/vuln/detail/CVE-2026-106586 external
https://access.redhat.com/security/cve/CVE-2026-106587 self
https://bugzilla.redhat.com/show_bug.cgi?id=2547207 external
https://www.cve.org/CVERecord?id=CVE-2026-106587 external
https://nvd.nist.gov/vuln/detail/CVE-2026-106587 external
https://access.redhat.com/security/cve/CVE-2026-110923 self
https://bugzilla.redhat.com/show_bug.cgi?id=2553028 external
https://www.cve.org/CVERecord?id=CVE-2026-110923 external
https://nvd.nist.gov/vuln/detail/CVE-2026-110923 external
https://access.redhat.com/security/cve/CVE-2026-110925 self
https://bugzilla.redhat.com/show_bug.cgi?id=2553034 external
https://www.cve.org/CVERecord?id=CVE-2026-110925 external
https://nvd.nist.gov/vuln/detail/CVE-2026-110925 external
https://access.redhat.com/security/cve/CVE-2026-110926 self
https://bugzilla.redhat.com/show_bug.cgi?id=2553035 external
https://www.cve.org/CVERecord?id=CVE-2026-110926 external
https://nvd.nist.gov/vuln/detail/CVE-2026-110926 external
https://access.redhat.com/security/cve/CVE-2026-110927 self
https://bugzilla.redhat.com/show_bug.cgi?id=2553037 external
https://www.cve.org/CVERecord?id=CVE-2026-110927 external
https://nvd.nist.gov/vuln/detail/CVE-2026-110927 external
Acknowledgments
Junghoon Cho
KeenLab SecBuddyF
Fabian Bäumer Marcus Brinkmann
1seal Oleh Konko
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\nopenssh:\n  * openssh-10.5p1-1.2.hum1 (aarch64, s390x, x86_64)\n  * openssh-askpass-10.5p1-1.2.hum1 (aarch64, s390x, x86_64)\n  * openssh-clients-10.5p1-1.2.hum1 (aarch64, s390x, x86_64)\n  * openssh-keycat-10.5p1-1.2.hum1 (aarch64, s390x, x86_64)\n  * openssh-keysign-10.5p1-1.2.hum1 (aarch64, s390x, x86_64)\n  * openssh-server-10.5p1-1.2.hum1 (aarch64, s390x, x86_64)\n  * openssh-sk-dummy-10.5p1-1.2.hum1 (aarch64, s390x, x86_64)\n  * openssh-10.5p1-1.2.hum1.src (src)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:82247",
        "url": "https://access.redhat.com/errata/RHSA-2026:82247"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-106586",
        "url": "https://access.redhat.com/security/cve/CVE-2026-106586"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-106583",
        "url": "https://access.redhat.com/security/cve/CVE-2026-106583"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-106587",
        "url": "https://access.redhat.com/security/cve/CVE-2026-106587"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-106552",
        "url": "https://access.redhat.com/security/cve/CVE-2026-106552"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-106582",
        "url": "https://access.redhat.com/security/cve/CVE-2026-106582"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-106584",
        "url": "https://access.redhat.com/security/cve/CVE-2026-106584"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-106585",
        "url": "https://access.redhat.com/security/cve/CVE-2026-106585"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-110925",
        "url": "https://access.redhat.com/security/cve/CVE-2026-110925"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-110926",
        "url": "https://access.redhat.com/security/cve/CVE-2026-110926"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-110923",
        "url": "https://access.redhat.com/security/cve/CVE-2026-110923"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-110927",
        "url": "https://access.redhat.com/security/cve/CVE-2026-110927"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_82247.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-10-20T04:11:06+00:00",
      "generator": {
        "date": "2026-10-20T04:11:06+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.2"
        }
      },
      "id": "RHSA-2026:82247",
      "initial_release_date": "2026-10-13T13:19:05+00:00",
      "revision_history": [
        {
          "date": "2026-10-13T13:19:05+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-15T13:52:13+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-20T04:11:06+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openssh-0:10.5p1-1.2.hum1@aarch64",
                "product": {
                  "name": "openssh-0:10.5p1-1.2.hum1@aarch64",
                  "product_id": "openssh-0:10.5p1-1.2.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssh@10.5p1-1.2.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssh-askpass-0:10.5p1-1.2.hum1@aarch64",
                "product": {
                  "name": "openssh-askpass-0:10.5p1-1.2.hum1@aarch64",
                  "product_id": "openssh-askpass-0:10.5p1-1.2.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssh-askpass@10.5p1-1.2.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssh-clients-0:10.5p1-1.2.hum1@aarch64",
                "product": {
                  "name": "openssh-clients-0:10.5p1-1.2.hum1@aarch64",
                  "product_id": "openssh-clients-0:10.5p1-1.2.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssh-clients@10.5p1-1.2.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssh-keycat-0:10.5p1-1.2.hum1@aarch64",
                "product": {
                  "name": "openssh-keycat-0:10.5p1-1.2.hum1@aarch64",
                  "product_id": "openssh-keycat-0:10.5p1-1.2.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssh-keycat@10.5p1-1.2.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssh-keysign-0:10.5p1-1.2.hum1@aarch64",
                "product": {
                  "name": "openssh-keysign-0:10.5p1-1.2.hum1@aarch64",
                  "product_id": "openssh-keysign-0:10.5p1-1.2.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssh-keysign@10.5p1-1.2.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssh-server-0:10.5p1-1.2.hum1@aarch64",
                "product": {
                  "name": "openssh-server-0:10.5p1-1.2.hum1@aarch64",
                  "product_id": "openssh-server-0:10.5p1-1.2.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssh-server@10.5p1-1.2.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64",
                "product": {
                  "name": "openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64",
                  "product_id": "openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssh-sk-dummy@10.5p1-1.2.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openssh-0:10.5p1-1.2.hum1@s390x",
                "product": {
                  "name": "openssh-0:10.5p1-1.2.hum1@s390x",
                  "product_id": "openssh-0:10.5p1-1.2.hum1@s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssh@10.5p1-1.2.hum1?arch=s390x\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssh-askpass-0:10.5p1-1.2.hum1@s390x",
                "product": {
                  "name": "openssh-askpass-0:10.5p1-1.2.hum1@s390x",
                  "product_id": "openssh-askpass-0:10.5p1-1.2.hum1@s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssh-askpass@10.5p1-1.2.hum1?arch=s390x\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssh-clients-0:10.5p1-1.2.hum1@s390x",
                "product": {
                  "name": "openssh-clients-0:10.5p1-1.2.hum1@s390x",
                  "product_id": "openssh-clients-0:10.5p1-1.2.hum1@s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssh-clients@10.5p1-1.2.hum1?arch=s390x\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssh-keycat-0:10.5p1-1.2.hum1@s390x",
                "product": {
                  "name": "openssh-keycat-0:10.5p1-1.2.hum1@s390x",
                  "product_id": "openssh-keycat-0:10.5p1-1.2.hum1@s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssh-keycat@10.5p1-1.2.hum1?arch=s390x\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssh-keysign-0:10.5p1-1.2.hum1@s390x",
                "product": {
                  "name": "openssh-keysign-0:10.5p1-1.2.hum1@s390x",
                  "product_id": "openssh-keysign-0:10.5p1-1.2.hum1@s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssh-keysign@10.5p1-1.2.hum1?arch=s390x\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssh-server-0:10.5p1-1.2.hum1@s390x",
                "product": {
                  "name": "openssh-server-0:10.5p1-1.2.hum1@s390x",
                  "product_id": "openssh-server-0:10.5p1-1.2.hum1@s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssh-server@10.5p1-1.2.hum1?arch=s390x\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x",
                "product": {
                  "name": "openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x",
                  "product_id": "openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssh-sk-dummy@10.5p1-1.2.hum1?arch=s390x\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openssh-0:10.5p1-1.2.hum1@src",
                "product": {
                  "name": "openssh-0:10.5p1-1.2.hum1@src",
                  "product_id": "openssh-0:10.5p1-1.2.hum1@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssh@10.5p1-1.2.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openssh-0:10.5p1-1.2.hum1@x86_64",
                "product": {
                  "name": "openssh-0:10.5p1-1.2.hum1@x86_64",
                  "product_id": "openssh-0:10.5p1-1.2.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssh@10.5p1-1.2.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssh-askpass-0:10.5p1-1.2.hum1@x86_64",
                "product": {
                  "name": "openssh-askpass-0:10.5p1-1.2.hum1@x86_64",
                  "product_id": "openssh-askpass-0:10.5p1-1.2.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssh-askpass@10.5p1-1.2.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssh-clients-0:10.5p1-1.2.hum1@x86_64",
                "product": {
                  "name": "openssh-clients-0:10.5p1-1.2.hum1@x86_64",
                  "product_id": "openssh-clients-0:10.5p1-1.2.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssh-clients@10.5p1-1.2.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssh-keycat-0:10.5p1-1.2.hum1@x86_64",
                "product": {
                  "name": "openssh-keycat-0:10.5p1-1.2.hum1@x86_64",
                  "product_id": "openssh-keycat-0:10.5p1-1.2.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssh-keycat@10.5p1-1.2.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssh-keysign-0:10.5p1-1.2.hum1@x86_64",
                "product": {
                  "name": "openssh-keysign-0:10.5p1-1.2.hum1@x86_64",
                  "product_id": "openssh-keysign-0:10.5p1-1.2.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssh-keysign@10.5p1-1.2.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssh-server-0:10.5p1-1.2.hum1@x86_64",
                "product": {
                  "name": "openssh-server-0:10.5p1-1.2.hum1@x86_64",
                  "product_id": "openssh-server-0:10.5p1-1.2.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssh-server@10.5p1-1.2.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64",
                "product": {
                  "name": "openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64",
                  "product_id": "openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssh-sk-dummy@10.5p1-1.2.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-0:10.5p1-1.2.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@aarch64"
        },
        "product_reference": "openssh-0:10.5p1-1.2.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-0:10.5p1-1.2.hum1@s390x as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@s390x"
        },
        "product_reference": "openssh-0:10.5p1-1.2.hum1@s390x",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-0:10.5p1-1.2.hum1@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@src"
        },
        "product_reference": "openssh-0:10.5p1-1.2.hum1@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-0:10.5p1-1.2.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@x86_64"
        },
        "product_reference": "openssh-0:10.5p1-1.2.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-askpass-0:10.5p1-1.2.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@aarch64"
        },
        "product_reference": "openssh-askpass-0:10.5p1-1.2.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-askpass-0:10.5p1-1.2.hum1@s390x as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@s390x"
        },
        "product_reference": "openssh-askpass-0:10.5p1-1.2.hum1@s390x",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-askpass-0:10.5p1-1.2.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@x86_64"
        },
        "product_reference": "openssh-askpass-0:10.5p1-1.2.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-clients-0:10.5p1-1.2.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@aarch64"
        },
        "product_reference": "openssh-clients-0:10.5p1-1.2.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-clients-0:10.5p1-1.2.hum1@s390x as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@s390x"
        },
        "product_reference": "openssh-clients-0:10.5p1-1.2.hum1@s390x",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-clients-0:10.5p1-1.2.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@x86_64"
        },
        "product_reference": "openssh-clients-0:10.5p1-1.2.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-keycat-0:10.5p1-1.2.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@aarch64"
        },
        "product_reference": "openssh-keycat-0:10.5p1-1.2.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-keycat-0:10.5p1-1.2.hum1@s390x as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@s390x"
        },
        "product_reference": "openssh-keycat-0:10.5p1-1.2.hum1@s390x",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-keycat-0:10.5p1-1.2.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@x86_64"
        },
        "product_reference": "openssh-keycat-0:10.5p1-1.2.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-keysign-0:10.5p1-1.2.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@aarch64"
        },
        "product_reference": "openssh-keysign-0:10.5p1-1.2.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-keysign-0:10.5p1-1.2.hum1@s390x as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@s390x"
        },
        "product_reference": "openssh-keysign-0:10.5p1-1.2.hum1@s390x",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-keysign-0:10.5p1-1.2.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@x86_64"
        },
        "product_reference": "openssh-keysign-0:10.5p1-1.2.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-server-0:10.5p1-1.2.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@aarch64"
        },
        "product_reference": "openssh-server-0:10.5p1-1.2.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-server-0:10.5p1-1.2.hum1@s390x as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@s390x"
        },
        "product_reference": "openssh-server-0:10.5p1-1.2.hum1@s390x",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-server-0:10.5p1-1.2.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@x86_64"
        },
        "product_reference": "openssh-server-0:10.5p1-1.2.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64"
        },
        "product_reference": "openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x"
        },
        "product_reference": "openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64"
        },
        "product_reference": "openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-106552",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-10-06T20:42:04.356779+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2547187"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSH. A malicious or compromised server can write files to unintended locations on a client system during a recursive copy operation using the SFTP (Secure File Transfer Protocol) client. By returning crafted file paths, the remote server can trigger a directory traversal and force the client to store files outside the designated destination directory, potentially overwriting existing local files.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssh: openssh: Arbitrary file write via directory traversal during sftp recursive copy",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in the OpenSSH sftp client, rated moderate severity by Red Hat Product Security. When a user performs a recursive copy operation from a malicious or compromised SFTP server, the server can return crafted file paths that trigger a directory traversal, causing the sftp client to write files outside the designated destination directory on the local system and potentially overwrite existing files writable by the user running the client. The impact is limited to the integrity and availability of files accessible to the local user: the flaw does not disclose information (confidentiality impact is none) and does not grant privileges beyond those of the local user. Exploitation requires a user to initiate a recursive copy against an attacker-controlled server, which is reflected in Red Hat\u0027s CVSS 3.1 score of 4.2 (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L); this is lower than the NIST score of 6.5 mainly because Red Hat assesses high attack complexity and low integrity and availability impacts bounded by the local user\u0027s file permissions, whereas NIST rates attack complexity as low and integrity impact as high. Within Red Hat, this flaw affects the openssh component in Red Hat Hardened Images; the fix is being pursued through the delegated Red Hat Hardened Images update process.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@src",
          "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-106552"
        },
        {
          "category": "external",
          "summary": "RHBZ#2547187",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547187"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-106552",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-106552"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-106552",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106552"
        },
        {
          "category": "external",
          "summary": "https://www.openssh.org/releasenotes.html#10.6",
          "url": "https://www.openssh.org/releasenotes.html#10.6"
        }
      ],
      "release_date": "2026-10-06T20:20:31.186000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-13T13:19:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@src",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:82247"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@src",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@src",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssh: openssh: Arbitrary file write via directory traversal during sftp recursive copy"
    },
    {
      "cve": "CVE-2026-106582",
      "cwe": {
        "id": "CWE-205",
        "name": "Observable Behavioral Discrepancy"
      },
      "discovery_date": "2026-10-06T20:41:38.989493+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2547181"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSH. When session compression is enabled, an attacker with access to a shared Secure Shell (SSH) connection can exploit the compression state shared across multiplexed channels. By analyzing changes in transmitted packet lengths caused by repeated data patterns, the attacker may deduce and recover sensitive plaintext information transmitted over concurrent channels in the same session.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssh: openssh: Information disclosure via shared compression side-channel",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A low severity information disclosure flaw was found in OpenSSH as included in Red Hat Hardened Images, where the openssh component is affected and a fix is being pursued through the product\u0027s delegated update process. When session compression is enabled, the LZ77 dictionary compression state is shared across all channels multiplexed over a single SSH connection. An attacker with the ability to send data over one channel of such a shared connection can perform a chosen-plaintext attack: because LZ77 replaces repeated strings with back-references into the shared search buffer, attacker-controlled input reflects measurably into the length of transmitted packets, allowing sensitive plaintext sent over a concurrent channel of the same session to be deduced and partially recovered. Exploitation requires session compression (a non-default option) to be enabled and trusted and untrusted traffic to be multiplexed over the same SSH connection, which limits practical exposure. Red Hat and upstream both assess this issue as low severity (CVSS 3.1 score 3.7).",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@src",
          "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-106582"
        },
        {
          "category": "external",
          "summary": "RHBZ#2547181",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547181"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-106582",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-106582"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-106582",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106582"
        },
        {
          "category": "external",
          "summary": "https://arxiv.org/abs/2609.07709",
          "url": "https://arxiv.org/abs/2609.07709"
        },
        {
          "category": "external",
          "summary": "https://www.openssh.org/releasenotes.html#10.6",
          "url": "https://www.openssh.org/releasenotes.html#10.6"
        }
      ],
      "release_date": "2026-10-06T20:35:32.577000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-13T13:19:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@src",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:82247"
        },
        {
          "category": "workaround",
          "details": "Session compression is not enabled by default in OpenSSH; keeping it disabled prevents this side-channel. Set \u0027Compression no\u0027 in sshd_config on servers and in ssh_config (or use \u0027ssh -o Compression=no\u0027) on clients where compression has been enabled. Avoid multiplexing trusted and untrusted traffic over a single shared SSH connection, for example via ssh connection multiplexing (ControlMaster). Where compression of transferred data is required, applying compression at the application level before data enters the SSH session is not affected by this type of attack. A fix is being pursued for the affected Red Hat Hardened Images product.",
          "product_ids": [
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@src",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@src",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "openssh: openssh: Information disclosure via shared compression side-channel"
    },
    {
      "cve": "CVE-2026-106583",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "discovery_date": "2026-10-06T23:50:58.683900+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2547243"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSH. The OpenSSH client insufficiently sanitizes command-line usernames containing special characters, such as dollar signs and backslashes. When untrusted input is passed to the client command line, an attacker can exploit this issue to perform command injection through shell-evaluated options such as ProxyCommand, potentially leading to arbitrary command execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssh: openssh: Command injection via unvalidated command-line username",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A low-impact command injection flaw was found in the OpenSSH client. The ssh client did not restrict \u0027$\u0027 and \u0027\\\u0027 characters in usernames supplied on the command line. When an application or wrapper script passes an attacker-controlled username to the ssh command line and the client configuration evaluates shell commands that expand the username, such as ProxyCommand or Match exec, an attacker could inject and execute arbitrary shell commands in the context of the local user. Red Hat Product Security rates this flaw Low severity (CVSS 3.1 score of 2.5) because exploitation requires local invocation of the ssh client with an attacker-controlled username together with a non-default configuration that expands the username in a shell context, limiting the impact to the integrity of the local user\u0027s session; this differs from the NVD severity of 7.8, which assumes no privileges are required and a full compromise of confidentiality, integrity, and availability. Within Red Hat\u0027s portfolio, only the openssh package in Red Hat Hardened Images (hummingbird-1) is affected, and a fix for that product is being pursued through its delegated update stream.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@src",
          "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-106583"
        },
        {
          "category": "external",
          "summary": "RHBZ#2547243",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547243"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-106583",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-106583"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-106583",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106583"
        },
        {
          "category": "external",
          "summary": "https://www.openssh.org/releasenotes.html#10.6",
          "url": "https://www.openssh.org/releasenotes.html#10.6"
        }
      ],
      "release_date": "2026-10-06T23:42:14.374000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-13T13:19:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@src",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:82247"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@src",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 2.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@src",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "openssh: openssh: Command injection via unvalidated command-line username"
    },
    {
      "cve": "CVE-2026-106584",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-10-06T21:01:45.989122+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2547201"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSH. During certificate generation with the ssh-keygen utility, Daylight Saving Time (DST) is mishandled when converting dates. This flaw can cause certificates to be issued with incorrect expiration times, potentially allowing them to remain valid longer than intended or expire prematurely.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssh: openssh: Incorrect certificate expiration times via Daylight Saving Time mishandling",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in the OpenSSH ssh-keygen utility, which is used for certificate generation and is included in Red Hat Hardened Images. When converting dates, ssh-keygen mishandles Daylight Saving Time (DST), which can cause generated certificates to be issued with expiration times that differ from the intended time by up to one hour (or up to two hours in the Antarctica/Troll timezone). Consequently, a certificate may remain valid slightly longer than intended or expire prematurely. Red Hat has rated this flaw as having low security impact (CVSS 3.1 score 2.5: AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N) because triggering the issue requires local execution of ssh-keygen with date, time, and timezone settings that coincide with a DST transition, and the flaw has no impact on confidentiality or availability. The openssh component in Red Hat Hardened Images is affected, and a fix is being pursued for that product.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@src",
          "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-106584"
        },
        {
          "category": "external",
          "summary": "RHBZ#2547201",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547201"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-106584",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-106584"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-106584",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106584"
        },
        {
          "category": "external",
          "summary": "https://www.openssh.org/releasenotes.html#10.6",
          "url": "https://www.openssh.org/releasenotes.html#10.6"
        }
      ],
      "release_date": "2026-10-06T20:47:50.509000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-13T13:19:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@src",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:82247"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Users of the affected openssh packages in Red Hat Hardened Images should install the updated packages provided through their product\u0027s update channels.",
          "product_ids": [
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@src",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 2.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@src",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "openssh: openssh: Incorrect certificate expiration times via Daylight Saving Time mishandling"
    },
    {
      "cve": "CVE-2026-106585",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2026-10-06T21:01:42.912475+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2547200"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSH. A remote attacker can trigger a denial of service (DoS) or abnormal packet processing by transmitting crafted, highly compressed data to a vulnerable client or server. The application fails to verify that decompressed payloads remain within the maximum permitted packet length limits, allowing oversized packets to be processed.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssh: openssh: Denial of service via oversized decompressed packets",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw of moderate impact was found in OpenSSH, where the sshd server and ssh client do not verify that decompressed payloads remain within the maximum supported packet length when processing highly compressed data. A remote attacker who requires no privileges or user interaction could send crafted, highly compressed data to a vulnerable client or server, causing oversized decompressed packets to be processed, which can result in a denial of service or abnormal packet processing. Within Red Hat\u0027s portfolio, the openssh component shipped in the Red Hat Hardened Images (Hummingbird) offering is affected, and a fix is being pursued through the delegated maintenance process for that product. Red Hat rates this flaw Moderate severity with a CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L), consistent with the upstream severity rating.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@src",
          "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-106585"
        },
        {
          "category": "external",
          "summary": "RHBZ#2547200",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547200"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-106585",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-106585"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-106585",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106585"
        },
        {
          "category": "external",
          "summary": "https://www.openssh.org/releasenotes.html#10.6",
          "url": "https://www.openssh.org/releasenotes.html#10.6"
        }
      ],
      "release_date": "2026-10-06T20:52:39.850000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-13T13:19:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@src",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:82247"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@src",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@src",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssh: openssh: Denial of service via oversized decompressed packets"
    },
    {
      "cve": "CVE-2026-106586",
      "cwe": {
        "id": "CWE-267",
        "name": "Privilege Defined With Unsafe Actions"
      },
      "discovery_date": "2026-10-07T16:32:51.524818+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2547584"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSH. In configurations where tunnel forwarding is enabled on the server, the restrict option in the authorized keys configuration fails to properly block tunnel forwarding requests. An authenticated user connecting with a restricted key can exploit this issue to bypass intended access limitations and establish unauthorized network tunnels through the server.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssh: OpenSSH: Security restriction bypass via unenforced restrict directive in tunnel forwarding",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A low severity security restriction bypass affects the openssh component in Red Hat Hardened Images (hummingbird-1). In OpenSSH sshd, the authorized_keys \"restrict\" keyword is intended to disable all forwarding features for a key, but it was not being applied to tunnel forwarding. On servers where tunnel forwarding has been enabled (the PermitTunnel option is disabled by default), an authenticated user connecting with a key restricted via \"restrict\" could bypass the intended access limitation and establish unauthorized network tunnels through the server. The impact is limited to integrity; the flaw does not directly affect confidentiality or availability. Red Hat Hardened Images is affected, and a fix is being pursued through the delegated hummingbird-1 update stream. Red Hat rates this flaw low severity (CVSS 3.1 score 2.5) because exploitation requires an authenticated user with an assigned restricted key and a non-default server configuration that enables tunnel forwarding; NIST has rated it moderate (CVSS 3.1 score 4.3).",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@src",
          "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-106586"
        },
        {
          "category": "external",
          "summary": "RHBZ#2547584",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547584"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-106586",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-106586"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-106586",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106586"
        },
        {
          "category": "external",
          "summary": "https://www.openssh.org/releasenotes.html#10.6",
          "url": "https://www.openssh.org/releasenotes.html#10.6"
        }
      ],
      "release_date": "2026-10-06T20:57:09.067000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-13T13:19:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@src",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:82247"
        },
        {
          "category": "workaround",
          "details": "This flaw only affects servers where tunnel forwarding has been explicitly enabled; PermitTunnel is disabled by default in OpenSSH sshd. As a workaround, tunnel forwarding can be disabled by setting \"PermitTunnel no\" in /etc/ssh/sshd_config (or removing any configuration that enables it) and restarting the sshd service, which prevents restricted keys from establishing network tunnels. This flaw can also be resolved by updating to the corrected openssh packages available through the affected Red Hat Hardened Images update stream.",
          "product_ids": [
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@src",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 2.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@src",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "openssh: OpenSSH: Security restriction bypass via unenforced restrict directive in tunnel forwarding"
    },
    {
      "cve": "CVE-2026-106587",
      "cwe": {
        "id": "CWE-115",
        "name": "Misinterpretation of Input"
      },
      "discovery_date": "2026-10-06T21:30:59.595220+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2547207"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSH. When certain configuration options are set to \"none\" within a conditional block to disable a feature, the OpenSSH server daemon (sshd) incorrectly interprets the value as a literal file path rather than disabling the setting. A local attacker could exploit this issue by creating or manipulating a file named \"none\", potentially leading to improper access control enforcement or service disruption.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssh: OpenSSH: Improper access control via misinterpretation of disabled configuration options",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A low severity flaw was found in OpenSSH, affecting the openssh component shipped in Red Hat Hardened Images. Some sshd configuration options, including AuthorizedPrincipalsFile, are documented as accepting the value \"none\" to disable the corresponding feature. However, when such an option is overridden by a Match keyword in sshd_config(5), sshd incorrectly interprets \"none\" as a literal file path rather than disabling the feature. A local attacker with an unprivileged account on an affected system could exploit this by creating or manipulating a file named \"none\", potentially leading to improper access control enforcement or disruption of authentication or the sshd service. Exploitation requires a non-default configuration in which the affected options are set to \"none\" inside a conditional Match block. Red Hat rates this flaw as Low severity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L), consistent with the upstream NIST rating of Low (3.3). A fix for the affected Red Hat Hardened Images stream is being pursued through the delegated resolution process.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@src",
          "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-106587"
        },
        {
          "category": "external",
          "summary": "RHBZ#2547207",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547207"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-106587",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-106587"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-106587",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106587"
        },
        {
          "category": "external",
          "summary": "https://www.openssh.org/releasenotes.html#10.6",
          "url": "https://www.openssh.org/releasenotes.html#10.6"
        }
      ],
      "release_date": "2026-10-06T21:01:44.808000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-13T13:19:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@src",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:82247"
        },
        {
          "category": "workaround",
          "details": "As a workaround, avoid setting options that accept the value \"none\" (for example AuthorizedPrincipalsFile) inside sshd_config Match blocks, where sshd misinterprets the value as a literal file path. Instead, apply the \"none\" value at the global configuration level outside of Match blocks, where it correctly disables the feature, or restructure the configuration so that these options are not set to \"none\" via a Match keyword. This prevents sshd from reading a file named \"none\" that may be controlled by a local user. Alternatively, updating to a version of OpenSSH that includes the upstream fix resolves the issue.",
          "product_ids": [
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@src",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 3.6,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@src",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "openssh: OpenSSH: Improper access control via misinterpretation of disabled configuration options"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Junghoon Cho"
          ]
        }
      ],
      "cve": "CVE-2026-110923",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-10-15T03:16:14.465000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2553028"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSH. During an sftp copy, a malicious server can supply an empty name, a slash-only path, or a \"..\" basename that sftp uses as the local destination, writing outside the directory the user selected.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssh: openssh: sftp can write outside the destination directory from a server-supplied path",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Status: REJECTED\n\nReason: Duplicate\n\nCVE-2026-110923 has been marked as a duplicate of CVE-2026-106552.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@src",
          "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-110923"
        },
        {
          "category": "external",
          "summary": "RHBZ#2553028",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553028"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-110923",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-110923"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-110923",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110923"
        }
      ],
      "release_date": "2026-10-15T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-13T13:19:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@src",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:82247"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@src",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssh: openssh: sftp can write outside the destination directory from a server-supplied path"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "SecBuddyF"
          ],
          "organization": "KeenLab"
        }
      ],
      "cve": "CVE-2026-110925",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "discovery_date": "2026-10-15T04:13:16.313000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2553034"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSH. A username entered on the ssh command line can still contain \u0027$\u0027 or a non-trailing backslash. When a configuration expands %u inside ProxyCommand or Match exec, those characters are passed into the shell.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssh: openssh: \u0027$\u0027 and \u0027\\\u0027 in a command-line username expand through %u",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Status: REJECTED\n\nReason: Duplicate\n\nCVE-2026-110925 has been marked as a duplicate of CVE-2026-106583.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@src",
          "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-110925"
        },
        {
          "category": "external",
          "summary": "RHBZ#2553034",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553034"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-110925",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-110925"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-110925",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110925"
        }
      ],
      "release_date": "2026-10-15T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-13T13:19:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@src",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:82247"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@src",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssh: openssh: \u0027$\u0027 and \u0027\\\u0027 in a command-line username expand through %u"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Fabian B\u00e4umer",
            "Marcus Brinkmann"
          ]
        }
      ],
      "cve": "CVE-2026-110926",
      "cwe": {
        "id": "CWE-203",
        "name": "Observable Discrepancy"
      },
      "discovery_date": "2026-10-15T04:17:08.197000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2553035"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSH. When compression is negotiated, channels on the same connection share one LZ77 dictionary. A peer who can write on one channel can recover plaintext from another channel by chosen-plaintext lengths.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssh: openssh: shared LZ77 compression dictionary leaks plaintext across channels",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Status: REJECTED\n\nReason: Duplicate\n\nCVE-2026-110926 has been marked as a duplicate of CVE-2026-106582.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@src",
          "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-110926"
        },
        {
          "category": "external",
          "summary": "RHBZ#2553035",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553035"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-110926",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-110926"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-110926",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110926"
        }
      ],
      "release_date": "2026-10-15T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-13T13:19:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@src",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:82247"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@src",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssh: openssh: shared LZ77 compression dictionary leaks plaintext across channels"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Oleh Konko"
          ],
          "organization": "1seal"
        }
      ],
      "cve": "CVE-2026-110927",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-10-15T04:20:17.064000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2553037"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSH. After compression is negotiated, a compressed payload can expand past the maximum supported packet size because the inflate loop does not stop at that limit. Memory use grows in the process handling that connection.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssh: openssh: a compressed payload can expand past the maximum packet size",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Status: REJECTED\n\nReason: Duplicate\n\nCVE-2026-110927 has been marked as a duplicate of CVE-2026-106585.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@src",
          "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@x86_64",
          "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64",
          "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x",
          "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-110927"
        },
        {
          "category": "external",
          "summary": "RHBZ#2553037",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553037"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-110927",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-110927"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-110927",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110927"
        }
      ],
      "release_date": "2026-10-15T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-13T13:19:05+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@src",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:82247"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@src",
            "Red Hat Hardened Images:openssh-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-askpass-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-clients-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keycat-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-keysign-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-server-0:10.5p1-1.2.hum1@x86_64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@aarch64",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@s390x",
            "Red Hat Hardened Images:openssh-sk-dummy-0:10.5p1-1.2.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssh: openssh: a compressed payload can expand past the maximum packet size"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.