Medium severity4.3NVD Advisory· Published Apr 10, 2025· Updated Oct 15, 2026

CVE-2025-32728

Description

In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

osv-coords44 versions
pkg:rpm/suse/openssh&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7 pkg:rpm/suse/openssh-askpass-gnome&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP7 pkg:rpm/suse/openssh-askpass-gnome&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS pkg:rpm/suse/openssh&distro=SUSE%20Linux%20Enterprise%20Micro%205.2 pkg:rpm/suse/openssh-askpass-gnome&distro=SUSE%20Enterprise%20Storage%207.1 pkg:rpm/suse/openssh&distro=SUSE%20Linux%20Enterprise%20Micro%205.4 pkg:rpm/suse/openssh-askpass-gnome&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS pkg:rpm/suse/openssh&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS pkg:rpm/suse/openssh-askpass-gnome&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS pkg:rpm/suse/openssh-askpass-gnome&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS pkg:rpm/suse/openssh&distro=SUSE%20Manager%20Server%204.3 pkg:rpm/suse/openssh&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3 pkg:rpm/suse/openssh&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP6 pkg:rpm/suse/openssh-askpass-gnome&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSS pkg:rpm/suse/openssh&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS pkg:rpm/suse/openssh&distro=SUSE%20Manager%20Proxy%204.3 pkg:rpm/suse/openssh-askpass-gnome&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP6 pkg:rpm/opensuse/openssh&distro=openSUSE%20Tumbleweed pkg:rpm/almalinux/openssh-keycat pkg:rpm/almalinux/openssh-server pkg:rpm/opensuse/openssh-askpass-gnome&distro=openSUSE%20Leap%2015.6 pkg:rpm/suse/openssh&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS pkg:rpm/suse/openssh-askpass-gnome&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS pkg:rpm/suse/openssh-askpass-gnome&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3 pkg:rpm/suse/openssh&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4 pkg:rpm/suse/openssh&distro=SUSE%20Enterprise%20Storage%207.1 pkg:rpm/suse/openssh&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSS pkg:rpm/suse/openssh-askpass-gnome&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSS pkg:rpm/suse/openssh&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS pkg:rpm/suse/openssh&distro=SUSE%20Linux%20Enterprise%20Micro%205.3 pkg:rpm/suse/openssh&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS pkg:rpm/suse/openssh&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5 pkg:rpm/suse/openssh-askpass-gnome&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5 pkg:rpm/suse/openssh&distro=SUSE%20Linux%20Enterprise%20Micro%205.5 pkg:rpm/suse/openssh&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSS pkg:rpm/suse/openssh&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS pkg:rpm/suse/openssh-askpass-gnome&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS pkg:rpm/suse/openssh-askpass-gnome&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4 pkg:rpm/suse/openssh&distro=SUSE%20Linux%20Enterprise%20Micro%205.1 pkg:rpm/almalinux/openssh pkg:rpm/opensuse/openssh&distro=openSUSE%20Leap%2015.6 pkg:rpm/almalinux/openssh-clients pkg:rpm/almalinux/openssh-askpass pkg:rpm/almalinux/openssh-keysign
< 9.6p1-150600.6.26.1+ 43 more
- (no CPE)range: < 9.6p1-150600.6.26.1
- (no CPE)range: < 9.6p1-150600.6.26.1
- (no CPE)range: < 8.4p1-150300.3.49.1
- (no CPE)range: < 8.4p1-150300.3.49.1
- (no CPE)range: < 8.4p1-150300.3.49.1
- (no CPE)range: < 8.4p1-150300.3.49.1
- (no CPE)range: < 8.4p1-150300.3.49.1
- (no CPE)range: < 8.4p1-150300.3.49.1
- (no CPE)range: < 8.4p1-150300.3.49.1
- (no CPE)range: < 8.4p1-150300.3.49.1
- (no CPE)range: < 8.4p1-150300.3.49.1
- (no CPE)range: < 8.4p1-150300.3.49.1
- (no CPE)range: < 9.6p1-150600.6.26.1
- (no CPE)range: < 8.4p1-150300.3.49.1
- (no CPE)range: < 8.4p1-150300.3.49.1
- (no CPE)range: < 8.4p1-150300.3.49.1
- (no CPE)range: < 9.6p1-150600.6.26.1
- (no CPE)range: < 10.0p2-2.1
- (no CPE)range: < 9.9p1-11.el10.alma.1
- (no CPE)range: < 9.9p1-11.el10.alma.1
- (no CPE)range: < 9.6p1-150600.6.26.1
- (no CPE)range: < 8.4p1-150300.3.49.1
- (no CPE)range: < 8.4p1-150300.3.49.1
- (no CPE)range: < 8.4p1-150300.3.49.1
- (no CPE)range: < 8.4p1-150300.3.49.1
- (no CPE)range: < 8.4p1-150300.3.49.1
- (no CPE)range: < 8.4p1-150300.3.49.1
- (no CPE)range: < 8.4p1-150300.3.49.1
- (no CPE)range: < 8.4p1-150300.3.49.1
- (no CPE)range: < 8.4p1-150300.3.49.1
- (no CPE)range: < 8.4p1-150300.3.49.1
- (no CPE)range: < 8.4p1-150300.3.49.1
- (no CPE)range: < 8.4p1-150300.3.49.1
- (no CPE)range: < 8.4p1-150300.3.49.1
- (no CPE)range: < 8.4p1-150300.3.49.1
- (no CPE)range: < 8.4p1-150300.3.49.1
- (no CPE)range: < 8.4p1-150300.3.49.1
- (no CPE)range: < 8.4p1-150300.3.49.1
- (no CPE)range: < 8.4p1-150300.3.49.1
- (no CPE)range: < 9.9p1-11.el10.alma.1
- (no CPE)range: < 9.6p1-150600.6.26.1
- (no CPE)range: < 9.9p1-11.el10.alma.1
- (no CPE)range: < 9.9p1-11.el10.alma.1
- (no CPE)range: < 9.9p1-11.el10.alma.1
OpenBSD/OpenSSH2 versions
cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*range: >=7.4,<10.0
- (no CPE)range: 7.4
Debian/linux
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
OpenSSH/sshdllm-fuzzy
Range: <10.0
OpenSSH/openssh-portablellm-fuzzy
Range: <10.0

Patches

Vulnerability mechanics

References

github.com/openssh/openssh-portable/commit/fc86875e6acb36401dfc1dfb6b628a9d1460f367nvdPatch
lists.debian.org/debian-lts-announce/2025/05/msg00008.htmlnvdMailing ListThird Party Advisory
security.netapp.com/advisory/ntap-20250425-0002/nvdThird Party Advisory
ftp.openbsd.org/pub/OpenBSD/patches/7.6/common/013_ssh.patch.signvdProduct
lists.mindrot.org/pipermail/openssh-unix-dev/2025-April/041879.htmlnvdMailing ListProductRelease Notes
www.openssh.com/txt/release-10.0nvdRelease Notes
www.openssh.com/txt/release-7.4nvdRelease Notes
cert-portal.siemens.com/productcert/html/ssa-398330.htmlnvd

News mentions

Only a Handful of CVEs Mattered for Supply Chain in 2025
GovInfoSecurity · May 19, 2026

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000