OpenSSH 10.4 Patches Six Vulnerabilities in Authentication and File Transfer Components
OpenSSH versions before 10.4 are affected by six vulnerabilities disclosed on July 8, 2026, impacting authentication, denial-of-service, and file transfer security.
Key findings
- Six OpenSSH vulnerabilities disclosed on July 8, 2026, affecting versions prior to 10.4.
- Flaws impact
sshdauthentication, DoS, and file transfer components (sftp,scp). - Vulnerabilities include mishandled auth delays, DoS via auth attempts, and improper file path constraints.
internal-sftpargument handling andscpremote-to-remote copy issues also disclosed.- All issues are addressed in OpenSSH version 10.4.
On July 8, 2026, a batch of six vulnerabilities affecting OpenSSH versions prior to 10.4 was disclosed. These vulnerabilities, all patched in version 10.4, span various components including sshd, internal-sftp, sftp, and scp, and could lead to denial of service, improper file handling, and bypasses of security configurations. The disclosures highlight potential weaknesses in authentication, file transfer, and forwarding mechanisms within the widely used SSH daemon.
Several vulnerabilities relate to improper handling of authentication and connection settings. CVE-2026-60001 indicates that sshd did not consistently enforce minimum authentication delays, potentially allowing for faster brute-force attacks. Similarly, CVE-2026-60000 describes a denial-of-service vulnerability where sshd could be overwhelmed by excessive authentication attempts due to mishandling of MaxAuthTries for GSSAPIAuthentication. Another configuration-related issue, CVE-2026-59999, points out that DisableForwarding=yes did not take precedence over PermitTunnel=yes as intended, potentially allowing unintended tunneling.
The file transfer components of OpenSSH are also affected by multiple flaws. CVE-2026-59997 notes that internal-sftp in sshd only recognized the first nine command-line arguments, which could undermine security properties if later arguments were critical. CVE-2026-59995 details how sftp could fail to properly constrain the location of downloaded files when used with the sftp server:/path . syntax, especially with an attacker-controlled server. Lastly, CVE-2026-59996 reveals that scp might place files in unintended parent directories when copying between two remote hosts.
These vulnerabilities were disclosed together, indicating a coordinated release of security information. Users of OpenSSH are strongly advised to update to version 10.4 or later to mitigate these risks. The diverse nature of these flaws, affecting authentication, DoS, and file transfer security, underscores the importance of maintaining up-to-date SSH configurations and software.
The timely patching of these issues is crucial for maintaining secure remote access and data transfer operations, as OpenSSH is a foundational component for secure communication in many IT environments. Users should verify their OpenSSH version and apply the update promptly.