CVE-2026-3497: OpenSSH GSSAPI uninitialized variable use in Linux distributions

CVE-2026-3497 · Severity: high · CVSS 7.5 · Published 2026-03-12

A vulnerability exists in the OpenSSH component of several major Linux distributions, including Ubuntu, Debian, and Red Hat. This issue affects the GSSAPI key exchange mechanism, which is often used for secure authentication in enterprise environments. An unauthenticated attacker can send a specially crafted network packet to crash the SSH service or potentially access sensitive memory, leading to a denial of service or information disclosure.

Technologies: Debian Linux, OpenBSD Openssh. Vendors: Debian, OpenBSD.

Quick answers

Is CVE-2026-3497 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-3497 being exploited in the wild.
How severe is CVE-2026-3497?
High severity, with a CVSS score of 7.5, published 12 March 2026.
Which products and versions are affected?
Debian Linux 11.0; OpenBSD Openssh Impacted by distribution-specific patches.
Is there a fix for CVE-2026-3497?
A patch was published on 2026-03-12: Fixes released for Ubuntu 20.04, 22.04, 24.04, and 25.10 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-3497 attacked?
It is attacked over the network, in an operating system.
Am I affected by CVE-2026-3497?
Check whether you run Debian Linux or OpenBSD Openssh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability stems from a code defect in the GSSAPI Key Exchange patch (kexgsss.c) where sshpkt_disconnect() is used instead of the terminating ssh_packet_disconnect() function. When an unexpected GSSAPI message type is received, the non-terminating error handler allows execution to fall through into code that accesses an uninitialized stack variable (recv_tok). This leads to an uninitialized pointer dereference and a subsequent call to gss_release_buffer(), which may attempt to free a garbage pointer. Depending on compiler hardening and optimization, this can result in a 100% reliable child process crash (SIGABRT/SIGSEGV) or a privilege separation boundary violation where up to 127KB of heap data is sent to the root monitor process via IPC. The vulnerability is exploitable pre-authentication if GSSAPIKeyExchange is enabled.

Affected products

  • Canonical Ubuntu Linux 20.04 LTS, 22.04 LTS, 24.04 LTS, 25.10
  • Red Hat Enterprise Linux 8, 9, 10
  • Debian Debian Linux 11.0
  • Various Linux Distributions OpenSSH (GSSAPI Patch) Impacted by distribution-specific patches

Timeline

  • 2026-03-12: disclosed: Initial disclosure by Canonical and Jeremy Brown
  • 2026-03-12: advisory: Ubuntu published USN-8090-1 and USN-8090-2
  • 2026-03-12: patched: Fixes released for Ubuntu 20.04, 22.04, 24.04, and 25.10
  • 2026-03-12: other: CVE-2026-3497 assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.