CVE-2026-55654: OpenBSD OpenSSH DoS Vulnerability

CVE-2026-55654 Overview

CVE-2026-55654 is a heap out-of-bounds read vulnerability in OpenSSH affecting the cleanup of Generic Security Service Application Programming Interface (GSSAPI) authentication indicators. The flaw stems from a missing trailing NULL termination in the auth-indicators array, which causes the SSH authentication path to read past allocated memory. A remote attacker can trigger the condition only under specific configurations involving GSSAPI authentication and a Kerberos environment. Successful exploitation crashes or aborts the SSH authentication routine, producing a denial of service against the SSH daemon. The issue is tracked under [CWE-125] and affects OpenBSD OpenSSH alongside several Red Hat Enterprise Linux releases.

Critical Impact
Remote attackers can abort the SSH authentication path on GSSAPI/Kerberos-enabled servers, disrupting administrative access and remote management availability.

Affected Products

OpenBSD OpenSSH
Red Hat Enterprise Linux 6, 7, 8, 9, and 10
Red Hat Hardened Images

Discovery Timeline

2026-06-23 - CVE-2026-55654 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-55654

Vulnerability Analysis

The vulnerability resides in OpenSSH's GSSAPI authentication cleanup routine. When OpenSSH processes GSSAPI authentication, it populates an auth-indicators array that tracks Kerberos authentication indicators returned by the credential provider. The cleanup logic iterates this array expecting a trailing NULL sentinel to mark the end of valid entries. When the sentinel is absent, iteration proceeds past the allocated buffer, triggering a heap out-of-bounds read.

The out-of-bounds read causes undefined behavior in the SSH authentication path. In practice, the server process crashes or aborts before completing authentication. Because sshd typically forks per-connection, the crash terminates the authentication session rather than the parent listener, but repeated triggering blocks legitimate authentication attempts and degrades service availability.

The affected configuration requires GSSAPI authentication (GSSAPIAuthentication yes) to be enabled and a working Kerberos backend. Default OpenSSH builds with GSSAPI disabled are not vulnerable. The attack requires no privileges and no user interaction, but exploitation complexity is elevated because the Kerberos environment must accept the attacker's authentication attempt to reach the vulnerable cleanup path.

Root Cause

The root cause is a missing NULL terminator in the auth-indicators array constructed during GSSAPI authentication. The cleanup loop relies on the sentinel to bound iteration. Without it, the loop reads adjacent heap memory and dereferences invalid pointers, classified as [CWE-125] Out-of-Bounds Read.

Attack Vector

A remote attacker initiates an SSH connection to a server with GSSAPI authentication enabled and supplies crafted GSSAPI credentials. Processing those credentials causes the indicator array to be built without the expected terminator. When OpenSSH enters the cleanup path, the out-of-bounds read aborts the authentication process and denies service for that connection. Repeated connections amplify the impact against availability of the SSH service.

No verified proof-of-concept code is available. Refer to the Red Hat CVE-2026-55654 Advisory for vendor-specific technical detail.

Detection Methods for CVE-2026-55654

Indicators of Compromise

Unexpected sshd child process crashes or SIGABRT entries in /var/log/messages, /var/log/secure, or journalctl -u sshd correlated with GSSAPI authentication attempts.
Core dumps generated from sshd referencing GSSAPI cleanup symbols in the stack trace.
Repeated incomplete SSH authentication sessions from the same source IP targeting Kerberos-enabled hosts.

Detection Strategies

Monitor sshd audit logs for fatal: and Connection closed by messages following GSSAPI key exchange.
Compare installed OpenSSH package versions against vendor advisories to identify unpatched hosts.
Alert on a rising rate of SSH authentication failures specifically tied to GSSAPI mechanism negotiation.

Monitoring Recommendations

Enable verbose LogLevel VERBOSE in sshd_config to capture GSSAPI negotiation details.
Forward SSH and Kerberos KDC logs to a centralized analytics platform for correlation.
Track sshd process restart counts and core file generation as availability health metrics.

How to Mitigate CVE-2026-55654

Immediate Actions Required

Inventory all hosts running OpenSSH with GSSAPIAuthentication yes and prioritize them for patching.
Apply vendor-supplied OpenSSH updates from Red Hat or the upstream OpenBSD project as soon as they are available.
Restrict SSH exposure on Kerberos-integrated servers to trusted management networks until patches are deployed.

Patch Information

Red Hat tracks the fix under Red Hat Bugzilla ID 2462493 and the Red Hat CVE-2026-55654 Advisory. Apply the updated openssh-server package for the relevant Red Hat Enterprise Linux release (6, 7, 8, 9, or 10) and restart the sshd service. OpenBSD users should track the upstream OpenSSH release notes for the corresponding fix.

Workarounds

Disable GSSAPI authentication on hosts that do not require it by setting GSSAPIAuthentication no in /etc/ssh/sshd_config.
Limit inbound SSH access to known administrative source addresses using firewall rules or host-based access control.
Require multi-factor or certificate-based authentication front-ends to reduce attacker reachability to the GSSAPI code path.

bash

# Configuration example: disable GSSAPI authentication until patched
sudo sed -i 's/^#\?GSSAPIAuthentication.*/GSSAPIAuthentication no/' /etc/ssh/sshd_config
sudo sshd -t && sudo systemctl restart sshd

# Verify the active setting
sudo sshd -T | grep -i gssapiauthentication