Back Linuxsecurity

Fedora 43 OpenSSH Important Fixes for Client-Side DoS CVE-2026

Linuxsecurity •LinuxSecurity Advisories • July 11, 2026

CVE-2026-55653: Fix double free in openssh DH-GEX client path during FIPS known- group validation that leads to client-side denial of service CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator cleanup due to missing NULL terminator CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket pre-binding

* Tue Jul 7 2026 Zoltan Fridrich - 10.0p1-10 - CVE-2026-55653: Fix double free in openssh DH-GEX client path during FIPS known-group validation that leads to client-side denial of service - CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator cleanup due to missing NULL terminator - CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket pre-binding

[ 1 ] Bug #2442505 - 0043-openssh-8.7p1-ssh-manpage.patch introduces duplicates in documentation

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-95b955a09b' at the command line. For more information, refer to the dnf documentation available at

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fedora OpenSSH Vulnerabilities Lead to Client-Side DoS Risks Recent updates to Fedora's OpenSSH have addressed critical vulnerabilities identified as CVE-2026-55653, CVE-2026-55654, and CVE-2026-55655. These vulnerabilities include a double free error in the DH-GEX client path, a heap out-of-bounds read during GSSAPI cleanup, and a potential MITM attack via X11 forwarding. The flaws can lead to client-side denial of service and compromise the security of X11 sessions. Affected systems include Fedora versions 43 and 44. The vulnerabilities were published on June 23, 2026, and patches were released on July 7, 2026. Users are advised to update their systems using the 'dnf' package manager to mitigate these risks. The issues were reported by developers Zoltan Fridrich and Dmitry Belyavskiy. 2 sources 58

Extracted Entities

Fedora 43 OpenSSH Important Fixes for Client-Side DoS CVE-2026

The full story

Extracted Entities

Attack Types (1)

CVEs (3)

CWE Weaknesses (2)

Platforms (1)