CVE-2026-60002

CriticalCVSS 9.4/10Last modified Oct 25, 2026

Description

ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)

Metrics

CVSS 3.1 9.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
OpenBSD	OpenSSH	< 10.4

References

https://marc.info/?l=openssh-unix-dev&m=178333966933090&w=2Release Notes
https://www.openssh.org/releasenotes.html#10.4p1Release Notes
https://www.openwall.com/lists/oss-security/2026/07/06/5Mailing List, Release Notes

Timeline

Published: Jul 8, 2026
Last modified: Oct 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-600049.8Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.CVE-2026-600058.2NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captur CVE-2026-600077.4In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding a CVE-2026-600083.5Gitea's Jupyter notebook renderer inserts the notebook's language_info.name metadata into a CSS class attribute while disabling sanitization CVE-2026-600098.8In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled CVE-2026-60018.8Authorization bypass through User-Controlled key vulnerability in ABIS Technology Ltd. Co. BAPSİS allows Exploitation of Trusted Identifiers CVE-2026-600106.5Gitea's repository-side team-link API allows a repository administrator who is not an organization owner to attach organization teams to a r CVE-2026-600115.3Sharp and Toshiba Tec MFPs (multifunction printers) fail to properly authorize requests to directly access certain image data stored to the CVE-2026-600186.5Gitea's OneDev migration downloader reads the entire remote version response into memory without a size limit and uses a client without a ti CVE-2026-60028.8Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in DivvyDrive Information Technologies Inc. Divv CVE-2026-600204.6Missing release of memory after effective lifetime in the MigTD virtio-serial driver for the Intel(R) TDX Migration Trust Domain (MigTD) wit CVE-2026-600216.5Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the migration task's cancellation c