High severity7.7NVD Advisory· Published Jul 8, 2026· Updated Jul 9, 2026
CVE-2026-60002
CVE-2026-60002
Description
ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)
Affected products
11- osv-coords9 versionspkg:rpm/opensuse/openssh&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/openssh-askpass-gnome&distro=openSUSE%20Leap%2016.0pkg:rpm/almalinux/opensshpkg:rpm/almalinux/openssh-keysignpkg:rpm/almalinux/openssh-askpasspkg:rpm/almalinux/openssh-clientspkg:rpm/almalinux/openssh-keycatpkg:rpm/almalinux/openssh-serverpkg:rpm/almalinux/pam_ssh_agent_auth
< 10.0p2-160000.7.1+ 8 more
- (no CPE)range: < 10.0p2-160000.7.1
- (no CPE)range: < 10.0p2-160000.7.1
- (no CPE)range: < 9.9p1-9.el9_8.alma.1
- (no CPE)range: < 9.9p1-25.el10_2.alma.1
- (no CPE)range: < 9.9p1-9.el9_8.alma.1
- (no CPE)range: < 9.9p1-9.el9_8.alma.1
- (no CPE)range: < 9.9p1-9.el9_8.alma.1
- (no CPE)range: < 9.9p1-9.el9_8.alma.1
- (no CPE)range: < 0.10.4-7.9.el9_8.alma.1
Patches
Vulnerability mechanics
References
3- marc.infonvdRelease Notes
- www.openssh.org/releasenotes.htmlnvdRelease Notes
- www.openwall.com/lists/oss-security/2026/07/06/5nvdMailing ListRelease Notes
News mentions
0No linked articles in our index yet.