{"id":183658,"date":"2026-10-06T22:53:58","date_gmt":"2026-10-06T20:53:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/vypusk-openssh-10-6-s-ustraneniem-uyazvimostej"},"modified":"2026-10-06T22:54:02","modified_gmt":"2026-10-06T20:54:02","slug":"openssh-10-6-released-with-vulnerability-fixes","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/openssh-10-6-released-with-vulnerability-fixes","title":{"rendered":"OpenSSH 10.6 has been released with vulnerabilities fixed.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
OpenSSH 10.6 has been released, an open implementation of a client and server for operating with SSH 2.0 and SFTP protocols. Security issues have been resolved, most of which were identified through code analysis using AI tools (CVE identifiers have not been assigned): <\/p>\n
\n
A vulnerability in sftp allows for writing a file outside of the target directory when accessing a server controlled by malicious actors.\n
Two vulnerabilities in the GSSAPI implementation in sshd, caused by state retention between different authentication attempts. GSSAPI credentials could persist after a failed authentication attempt and be used in a subsequent successful authentication attempt. The issues arise when GSSAPIAuthentication is enabled.\n
Support for LZ77 compression has been disabled in sshd and ssh due to the possibility of a side-channel attack that allows the recovery of content from another session when connecting through a multiplexed connection shared with the victim, as malefactor-controlled input affects the overall length of encrypted messages transmitted (LZ77 replaces repeating strings with references in a common buffer for all channels).\n
The ssh utility prohibits the use of characters '$' and '\\' in usernames entered in the command line, as they could allow for code execution when substituting names in the ProxyCommand and Match exec directives specified in the settings.\n
In ssh-keygen, incorrect handling of daylight saving time has been fixed, which caused the certificate expiration date to shift by 1 hour.\n
To block the creation of zip bombs, checks for exceeding the maximum packet size during data unpacking have been added in sshd and ssh.\n
In sshd, a problem was resolved that allowed the bypass of restrictions imposed by the 'restrict' keyword in the authorized_keys file, which was not applied to tunnels (PermitTunnel).\n
In sshd, an incorrect parsing of the 'none' option inside Match blocks was fixed, which in some directives, such as AuthorizedPrincipalsFile, was interpreted as a filename rather than as an indication of disabling the directive.\n
In sshd, the lack of root privilege dropping on platforms that do not support file descriptor passing and require root rights for PTY allocation has been fixed. This issue manifests in QNX 6, SCO OpenServer 5, and when built with the '--disable-fd-passing' option. <\/ul>\n
Non-vulnerability-related changes: <\/p>\n
\n
Support for the hybrid cryptoalgorithm ssh-mldsa44-ed25519 is enabled, resilient against brute-force attacks by quantum computers.\n
The WarnWeakCrypto option has been implemented in sshd_config and is enabled by default to manage warnings about establishing connections using key agreement algorithms that are not resistant to brute-force attacks by quantum computers.\n
In ssh-keygen and ssh-add, implementation of the credProtect policy check in credentials is in place to meet verification requirements (PIN or biometrics) before accessing resident keys on FIDO tokens.\n
In ssh-add, the '-P' flag has been added to skip the optional input of a PIN for FIDO and PKCS#11 tokens.\n
In ssh, the ~I command has been implemented to display version information on local and remote systems.\n
In sftp, the mkdir\/lmkdir commands have been given the '-p' flag to create directories as needed.\n
In ssh-keygen, a 'hexdump' mode has been added for exporting keys in the form of hexadecimal dumps (for example, for embedding in documentation).\n
In ssh and sshd, the ChannelTimeout directive now allows specifying timeouts with millisecond precision.\n
The AgentSocketPath option has been added to sshd to specify the path to $SSH_AUTH_SOCK when forwarding the agent (e.g., user:.ssh\/agent for subdirectories in $HOME and shared:\/tmp for shared directories).\n
In ssh-agent, the '-A' flag has been added to specify directories with agent sockets in which prefixes 'user:' and 'shared:' are allowed, similar to the AgentSocketPath option.\n
In sshd, the checking of public keys has been separated from authentication attempts. An option 'PubkeyOptions max-pk-ok:nnnn' has been added to configure the number of public key check attempts (default is 6), after which the connection will be terminated due to the MaxAuthTries limit.\n
In ssh and sshd, support for the value 'all' has been added to the TCPKeepAlive option, including sending keepalive packets not only for the main connection but also for connections forwarded through it. <\/ul>\n