Vigie VulnDBEuropean-hosted Vulnerability DB
FR
Menu

CVE-2026-55653

Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to client-side denial of service

MEDIUM 4.3

At a glance

Source
NVD
EPSS
EPSS 0.53 % · percentile 45 ()
State
PUBLISHED
Published
Updated
Assigner
redhat
NVD status
Modified

Description

A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occurs during FIPS (Federal Information Processing Standards) mode known-group validation when the client processes attacker-controlled DH-GEX group parameters. Successful exploitation leads to client-side process termination, resulting in a Denial of Service (DoS).

Weaknesses (CWE)

References

Scores

VersionScoreVectorScored by
CVSS 3.1MEDIUM 4.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:Lredhat
CVSS 3.1MEDIUM 4.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:LNVD · secalert@redhat.com (Secondary)
CVSS 3.1MEDIUM 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HNVD · nvd@nist.gov (Primary)

European references

CERT-FR advisories

Affected configurations (NVD CPE)

Affected products

ProductVersions
Red Hat · Red Hat Enterprise Linux 10unaffected 0:9.9p1-25.el10_2 < *
Red Hat · Red Hat Enterprise Linux 10.0 Extended Update Supportunaffected 0:9.9p1-7.el10_0.5 < *
Red Hat · Red Hat Enterprise Linux 8unaffected 0:8.0p1-30.el8_10 < *
Red Hat · Red Hat Enterprise Linux 8unaffected 0:8.0p1-30.el8_10 < *
Red Hat · Red Hat Enterprise Linux 9unaffected 0:9.9p1-9.el9_8 < *
Red Hat · Red Hat Enterprise Linux 9unaffected 0:9.9p1-9.el9_8 < *
Red Hat · Red Hat Enterprise Linux 9.2 Update Services for SAP Solutionsunaffected 0:8.7p1-30.el9_2.13 < *
Red Hat · Red Hat Enterprise Linux 9.4 Update Services for SAP Solutionsunaffected 0:8.7p1-38.el9_4.10 < *
Red Hat · Red Hat Enterprise Linux 9.6 Extended Update Supportunaffected 0:8.7p1-45.el9_6.5 < *
Red Hat · Red Hat Hardened Imagesunaffected 10.3p1-6.hum1 < *
Red Hat · Red Hat OpenShift AI 3.0unaffected 1791818590 < *
Red Hat · Red Hat OpenShift AI 3.0unaffected 1791818589 < *
Red Hat · Red Hat OpenShift AI 3.0unaffected 1791818505 < *
Red Hat · Red Hat OpenShift AI 3.0unaffected 1791818496 < *
Red Hat · Red Hat OpenShift AI 3.0unaffected 1791818502 < *
Red Hat · Red Hat OpenShift AI 3.2unaffected 1791818602 < *
Red Hat · Red Hat OpenShift AI 3.2unaffected 1791818598 < *
Red Hat · Red Hat OpenShift AI 3.2unaffected 1791818512 < *
Red Hat · Red Hat OpenShift AI 3.2unaffected 1791818587 < *
Red Hat · Red Hat OpenShift AI 3.2unaffected 1791818778 < *

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD