Is CVE-2026-55654 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55654 being exploited in the wild.

How severe is CVE-2026-55654?

Low severity, with a CVSS score of 3.7, published 23 June 2026.

Is there a fix for CVE-2026-55654?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-55654 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-55654?

Check whether you run Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55654: OpenSSH heap out-of-bounds read in GSSAPI indicator cleanup

CVE-2026-55654 · Severity: low · CVSS 3.7 · Published 2026-06-23

A vulnerability exists in the OpenSSH service, which is used for secure remote access to servers. Under specific configurations involving Kerberos authentication, an attacker can cause the SSH service to crash during the login process. This results in a denial of service, preventing legitimate users from accessing the system remotely.

Technologies: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9. Vendors: Red Hat.

Quick answers

Is CVE-2026-55654 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55654 being exploited in the wild.
How severe is CVE-2026-55654?: Low severity, with a CVSS score of 3.7, published 23 June 2026.
Which products and versions are affected?: Red Hat OpenSSH 10.2p1-10.1.hum1; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more.
Is there a fix for CVE-2026-55654?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-55654 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-55654?: Check whether you run Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap out-of-bounds read exists in OpenSSH's GSSAPI implementation, specifically within the `ssh_gssapi_getindicators()` function in `gss-serv.c`. The vulnerability is caused by a missing NULL terminator in the `auth-indicators` pointer array; while `xrecallocarray()` is used to grow the array, the newly zeroed slot is immediately overwritten with a pointer to a new indicator string without allocating a subsequent sentinel slot. When sentinel-based consumers like `ssh_gssapi_userok()` or `ssh_gssapi_check_indicators()` iterate through this array, they may read past the allocated memory or attempt to `free()` invalid pointers. Exploitation requires `GSSAPIAuthentication` to be enabled and the use of Kerberos tickets containing authenticated `auth-indicators`. A successful exploit results in a crash or abort of the SSH authentication path, causing a denial of service.

Affected products

Red Hat OpenSSH 10.2p1-10.1.hum1
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Red Hat Enterprise Linux 10

Timeline

2026-04-26: disclosed: Reported to Red Hat by Aisle Research
2026-06-23: advisory: CVE published by NVD and Red Hat

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.