CVE-2026-55653: OpenBSD OpenSSH DoS Vulnerability

CVE-2026-55653 Overview

CVE-2026-55653 is a double free vulnerability [CWE-415] in OpenSSH affecting the Diffie-Hellman Group Exchange (DH-GEX) client code path. The flaw triggers during Federal Information Processing Standards (FIPS) mode known-group validation when the client parses attacker-controlled DH-GEX group parameters supplied by a malicious SSH server. Successful exploitation causes client-side process termination, resulting in a Denial of Service (DoS). The issue impacts upstream OpenBSD OpenSSH and downstream Red Hat distributions including Red Hat Enterprise Linux 6 through 10, OpenShift Container Platform 4.0, and Red Hat Hardened Images.

Critical Impact
A malicious SSH server can crash connecting OpenSSH clients operating in FIPS mode through crafted DH-GEX group parameters, disrupting automated SSH workflows and administrative sessions.

Affected Products

OpenBSD OpenSSH
Red Hat Enterprise Linux 6, 7, 8, 9, and 10
Red Hat OpenShift Container Platform 4.0 and Red Hat Hardened Images

Discovery Timeline

2026-06-23 - CVE-2026-55653 published to the National Vulnerability Database (NVD)
2026-06-25 - CVE-2026-55653 last updated in NVD database

Technical Details for CVE-2026-55653

Vulnerability Analysis

The vulnerability resides in the OpenSSH client implementation of the Diffie-Hellman Group Exchange (DH-GEX) key exchange. When OpenSSH operates under FIPS mode, the client validates DH parameters received from the server against an allow-list of known safe groups. During this known-group validation step, a memory management error causes the same heap allocation to be released twice, producing a double free [CWE-415] condition. The result is heap corruption that aborts the client process. Because the bug lives entirely in the client, an attacker controlling or impersonating an SSH server can reliably terminate any connecting client that negotiates DH-GEX under FIPS.

Root Cause

The root cause is improper ownership tracking of dynamically allocated DH group parameter structures along the FIPS validation path. After the validation routine frees the parameter buffer, a subsequent cleanup or error-handling routine releases the same pointer again instead of clearing it. The cleanup logic assumes a single owner, but the FIPS-specific branch introduces an additional free without nullifying the reference.

Attack Vector

Exploitation requires a victim to initiate an SSH connection to an attacker-controlled or compromised SSH server. User interaction is required because the client must voluntarily connect. The attacker responds to the key exchange with malicious DH-GEX group parameters that pass initial parsing but trigger the duplicated free during FIPS validation. No authentication is needed because the crash occurs during the key exchange phase, before user credentials are presented. The impact is limited to availability — the client process exits without disclosing data or executing attacker code.

No public proof-of-concept code or verified exploitation samples are available at the time of publication. Refer to the Red Hat CVE-2026-55653 Advisory for technical details.

Detection Methods for CVE-2026-55653

Indicators of Compromise

Unexpected ssh client process crashes or abort signals (SIGABRT) recorded in system logs or coredumpctl shortly after connection attempts to unfamiliar hosts.
Heap corruption messages from glibc such as double free or corruption written to stderr or journalctl output for SSH sessions.
Repeated SSH connection failures from automation accounts targeting external or untrusted SSH endpoints, particularly on FIPS-enabled hosts.

Detection Strategies

Monitor endpoint telemetry for abnormal termination of /usr/bin/ssh and correlated outbound TCP/22 sessions to non-allowlisted destinations.
Inspect SSH client debug output (ssh -vvv) for failures during the SSH2_MSG_KEX_DH_GEX_GROUP exchange when validating FIPS group parameters.
Hunt for SSH connections originating from FIPS-mode hosts toward newly observed or low-reputation server IP addresses.

Monitoring Recommendations

Centralize SSH client logs and host crash reports into a SIEM or data lake to identify clusters of client aborts tied to specific remote servers.
Track OpenSSH package versions across the fleet and alert when FIPS-enabled hosts run unpatched builds.
Baseline outbound SSH destinations per host and flag deviations, since exploitation requires the client to reach an attacker-controlled server.

How to Mitigate CVE-2026-55653

Immediate Actions Required

Apply vendor updates for OpenSSH as soon as patched packages become available from your distribution.
Restrict outbound SSH connections from FIPS-mode systems to known, trusted destinations using firewall egress rules.
Audit automation, CI/CD runners, and jump hosts that operate in FIPS mode for any unnecessary SSH connectivity to third-party endpoints.

Patch Information

Red Hat tracks the fix through Red Hat Bug Report #2462351 and the Red Hat CVE-2026-55653 Advisory. Administrators running Red Hat Enterprise Linux 6 through 10, OpenShift Container Platform 4.0, or Red Hat Hardened Images should install the updated openssh and openssh-clients packages once published. Upstream fixes are coordinated with the OpenBSD OpenSSH project.

Workarounds

Disable DH-GEX in the client configuration by setting an explicit KexAlgorithms list that excludes diffie-hellman-group-exchange-* entries in /etc/ssh/ssh_config or ~/.ssh/config.
Where operationally feasible, disable FIPS mode on hosts that must connect to untrusted SSH servers until patches are deployed, balanced against compliance requirements.
Use SSH bastion hosts to broker connections so client crashes are contained to a hardened, monitored tier rather than user workstations or automation nodes.

bash

# Client-side workaround: prefer key exchanges that avoid the affected DH-GEX path
# Append to /etc/ssh/ssh_config or ~/.ssh/config
Host *
    KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521