Back Linuxsecurity

Fedora OpenSSH Serious Denial of Service and Heap Vulnerabilities Issues

Linuxsecurity •LinuxSecurity Advisories • July 9, 2026

Improve GSS KEX algorithms documentation CVE-2026-55653: Fix double free in openssh DH-GEX client path during FIPS known- group validation that leads to client-side denial of service CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator cleanup due to missing NULL terminator CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket pre-binding

* Tue Jul 7 2026 Dmitry Belyavskiy - 10.2p1-12 - Improve GSS KEX algorithms documentation Patches are submitted by [email protected] Resolves: rhbz#2241564 * Tue Jul 7 2026 Zoltan Fridrich - 10.2p1-11 - CVE-2026-55653: Fix double free in openssh DH-GEX client path during FIPS known-group validation that leads to client-side denial of service - CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator cleanup due to missing NULL terminator - CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket pre-binding - Remove duplicate manpage entries from ssh(1) Resolves: rhbz#2442505

[ 1 ] Bug #2241564 - KexAlgorithms accepts gss-* algorithms in certain cases, but it is completely unclear what this does [ 2 ] Bug #2442505 - 0043-openssh-8.7p1-ssh-manpage.patch introduces duplicates in documentation

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-a80275b42d' at the command line. For more information, refer to the dnf documentation available at

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fedora OpenSSH Vulnerabilities Lead to Client-Side DoS Risks Recent updates to Fedora's OpenSSH have addressed critical vulnerabilities identified as CVE-2026-55653, CVE-2026-55654, and CVE-2026-55655. These vulnerabilities include a double free error in the DH-GEX client path, a heap out-of-bounds read during GSSAPI cleanup, and a potential MITM attack via X11 forwarding. The flaws can lead to client-side denial of service and compromise the security of X11 sessions. Affected systems include Fedora versions 43 and 44. The vulnerabilities were published on June 23, 2026, and patches were released on July 7, 2026. Users are advised to update their systems using the 'dnf' package manager to mitigate these risks. The issues were reported by developers Zoltan Fridrich and Dmitry Belyavskiy. 2 sources 58

Extracted Entities

Fedora OpenSSH Serious Denial of Service and Heap Vulnerabilities Issues

The full story

Extracted Entities

Attack Types (2)

CVEs (3)

CWE Weaknesses (2)

Domains (1)

Email Addresses (1)

Platforms (1)