Executive brief
A vulnerability exists in the OpenSSH service, which is used for secure remote access to servers. Under specific configurations involving Kerberos authentication, an attacker can cause the SSH service to crash during the login process. This results in a denial of service, preventing legitimate users from accessing the system remotely.
Technical details
A heap out-of-bounds read exists in OpenSSH's GSSAPI implementation, specifically within the `ssh_gssapi_getindicators()` function in `gss-serv.c`. The vulnerability is caused by a missing NULL terminator in the `auth-indicators` pointer array; while `xrecallocarray()` is used to grow the array, the newly zeroed slot is immediately overwritten with a pointer to a new indicator string without allocating a subsequent sentinel slot. When sentinel-based consumers like `ssh_gssapi_userok()` or `ssh_gssapi_check_indicators()` iterate through this array, they may read past the allocated memory or attempt to `free()` invalid pointers. Exploitation requires `GSSAPIAuthentication` to be enabled and the use of Kerberos tickets containing authenticated `auth-indicators`. A successful exploit results in a crash or abort of the SSH authentication path, causing a denial of service.
Affected products
- Red Hat OpenSSH 10.2p1-10.1.hum1
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux 10
Timeline
- 2026-04-26: disclosed: Reported to Red Hat by Aisle Research
- 2026-06-23: advisory: CVE published by NVD and Red Hat