Executive brief
A vulnerability in OpenSSH could allow a remote attacker to cause a denial of service by consuming server resources. This occurs because the system fails to properly limit authentication attempts when a specific login method (GSSAPI) is enabled. An attacker could exploit this to exhaust server memory or processing power, potentially making the remote access service unavailable to legitimate users.
Technical details
A resource exhaustion vulnerability exists in OpenSSH's sshd daemon prior to version 10.4. The vulnerability is rooted in the mishandling of the 'MaxAuthTries' configuration directive when 'GSSAPIAuthentication' is enabled. Specifically, the server fails to enforce authentication limits for GSSAPI attempts, allowing a remote, unauthenticated attacker to initiate excessive authentication requests. While the 'PerSourcePenalties' feature may provide some mitigation, the flaw can lead to a pre-authentication denial of service by consuming server resources. The issue is resolved in OpenSSH 10.4.
Affected products
- OpenBSD OpenSSH before 10.4
Timeline
- 2026-07-06: patched: OpenSSH 10.4 released with a fix.
- 2026-07-08: advisory: NVD published the CVE record.