Is CVE-2026-35387 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-35387 being exploited in the wild.

How severe is CVE-2026-35387?

Low severity, with a CVSS score of 3.1, published 2 April 2026.

Is there a fix for CVE-2026-35387?

A patch was published on 2026-04-02: Fixed in OpenSSH 10.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-35387 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-35387?

Check whether you run OpenBSD Openssh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35387: OpenSSH unintended ECDSA algorithm acceptance in sshd config

CVE-2026-35387 · Severity: low · CVSS 3.1 · Published 2026-04-02

OpenSSH is a widely used tool for secure remote access to servers. A configuration flaw in versions prior to 10.3 causes the software to incorrectly interpret settings meant to restrict specific encryption algorithms (ECDSA). Instead of allowing only the chosen algorithms, the system may permit any available ECDSA algorithm, potentially allowing connections using weaker encryption than intended by the administrator.

Technologies: OpenBSD Openssh. Vendors: OpenBSD.

Quick answers

Is CVE-2026-35387 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-35387 being exploited in the wild.
How severe is CVE-2026-35387?: Low severity, with a CVSS score of 3.1, published 2 April 2026.
Which products and versions are affected?: OpenBSD Openssh before 10.3.
Is there a fix for CVE-2026-35387?: A patch was published on 2026-04-02: Fixed in OpenSSH 10.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35387 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-35387?: Check whether you run OpenBSD Openssh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A logic error in OpenSSH's configuration parsing (sshd_config) affects how ECDSA algorithms are handled in PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms. If a user specifies a single ECDSA algorithm (e.g., ecdsa-sha2-nistp384), the parser misinterprets this as a wildcard, enabling all supported ECDSA algorithms. This bypasses intended cryptographic restrictions set by administrators. The vulnerability is reachable over the network without authentication, though exploitation depends on the specific security policy the administrator intended to enforce. The issue is resolved in OpenSSH version 10.3.

Affected products

OpenBSD OpenSSH before 10.3

Timeline

2026-04-02: disclosed: OpenSSH 10.3 release announcement
2026-04-02: patched: Fixed in OpenSSH 10.3
2026-04-02: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.