Back Cybersecuritynews

OpenSSH GSSAPI Vulnerability Allow an Attacker to Crash SSH Child Processes

Cybersecuritynews •Guru Baran • March 13, 2026

A significant vulnerability in the GSSAPI Key Exchange patch was applied by numerous Linux distributions on top of their OpenSSH packages. The flaw, tracked as CVE-2026-3497, was uncovered by security researcher Jeremy Brown. It allows an attacker to crash SSH child processes reliably and potentially violates privilege separation boundaries, all with a single crafted network […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

OpenSSH Vulnerabilities Lead to Denial of Service Risks in Ubuntu Multiple vulnerabilities in OpenSSH have been identified, affecting various Ubuntu versions, including 20.04 LTS. The vulnerabilities include a critical issue discovered by Jeremy Brown regarding the GSSAPI Key Exchange, which can lead to denial of service or arbitrary code execution (CVE-2026-3497). Additionally, David Leadbeater found vulnerabilities related to control characters in usernames (CVE-2025-61984) and NULL characters in ssh:// URIs (CVE-2025-61985), both of which can also allow for arbitrary code execution. The vulnerabilities were patched in updates released on March 12, 2026. Users are advised to update their systems to mitigate these risks. The issues primarily affect users with non-default configurations enabled. The vulnerabilities were disclosed in advisories from Ubuntu and Linuxsecurity. 5 sources 71

Extracted Entities

CVEs (1)

CVE-2026-3497

Platforms (2)

Linux OpenSSH