CVE-2026-55654: OpenSSH GSSAPI Heap Out-of-Bounds Read Denial of Service

Technical summary

CVE-2026-55654 is a heap out-of-bounds read vulnerability in OpenSSH's GSSAPI authentication indicator cleanup routine. The vulnerability stems from an improperly terminated auth-indicators array that lacks NULL termination during cleanup operations. Under GSSAPI and Kerberos authentication configurations, remote attackers can trigger an out-of-bounds memory read, causing the SSH authentication handler to crash. The vulnerability is classified as CWE-125 (out-of-bounds read).

Business impact

This vulnerability impacts SSH service availability in environments relying on GSSAPI/Kerberos authentication. A successful exploit causes temporary SSH service interruption, preventing legitimate users from authenticating until the service restarts. Organizations using centralized Kerberos authentication for SSH access face elevated risk of authentication disruption, which could disrupt remote access workflows and administrative access to critical systems.

Affected systems

OpenSSH across multiple platforms is vulnerable, including OpenBSD OpenSSH, Red Hat Hardened Images, and Red Hat Enterprise Linux. The vulnerability requires GSSAPI authentication and a Kerberos environment to be configured and actively in use. Organizations using password-only or key-based SSH authentication without GSSAPI are not affected.

Exploitability

Exploitability is constrained by configuration prerequisites. An attacker must operate on a network where the target SSH service has GSSAPI authentication enabled and Kerberos infrastructure is present. No authentication is required to trigger the crash, but specific network and authentication conditions must align. The low CVSS score (3.7) reflects limited practical impact despite remote network accessibility.

Remediation

Apply security updates from your SSH vendor. Red Hat and OpenBSD have released patches addressing the missing NULL termination in the auth-indicators array. Vendors' advisories contain specific patched version numbers—consult your distribution's security documentation for applicable updates. As a temporary measure, administrators can disable GSSAPI authentication if not operationally required, though this may break centralized authentication workflows.

Patch guidance

Obtain updates from your vendor's security advisory. Red Hat Enterprise Linux users should check Red Hat's security portal for patched versions across affected RHEL releases. OpenBSD OpenSSH users should upgrade to the latest patched release from openbsd.org. Verify that applied patches explicitly address the auth-indicators NULL termination issue before deploying to production. Test patches in non-production environments to confirm SSH service stability and GSSAPI functionality.

Detection guidance

Monitor SSH daemon logs for unusual authentication handler crashes or segmentation faults coinciding with GSSAPI authentication attempts. Look for repeated SSH service restarts or unexpected disconnections during the authentication phase from systems configured for Kerberos. Network-based detection is difficult without traffic inspection; focus monitoring on the SSH server logs and system kernel error messages. Organizations can enable verbose SSH logging to capture authentication-phase failures.

Why prioritize this

Priority should be moderate for organizations using GSSAPI/Kerberos SSH authentication; lower for environments using alternative authentication. The low CVSS score and configuration-specific nature mean this does not require emergency patching across all deployments. However, Kerberos-enabled environments should plan timely patching to maintain SSH availability. The DoS impact is significant within affected configurations despite the low numerical score.

Risk score, explained

CVSS 3.7 (LOW severity) reflects a network-accessible denial of service with limited scope. The attack vector is network-based (AV:N) but requires high attack complexity (AC:H) due to configuration and environmental prerequisites. No authentication is needed (PR:N), but impact is limited to availability (A:L) with no confidentiality or integrity compromise. The score appropriately penalizes exploitability barriers while acknowledging the real DoS potential within targeted deployments.

Frequently asked questions