Critical Vulnerabilities in Fedora SSH Component Expose Users to Command Execution Risks

Fedora has released updates addressing two critical vulnerabilities in the opkssh component, identified as CVE-2026-39828 and CVE-2026-39830. Both vulnerabilities were published on May 22, 2026, and affect users of Fedora 43 and 44. CVE-2026-39828 allows unauthorized command execution due to improper handling of SSH permissions, while CVE-2026-39830 leads to denial of service through resource leaks from unsolicited SSH responses. The vulnerabilities can be exploited by attackers to gain unauthorized access or disrupt service. Users are advised to apply the updates using the 'dnf' package manager. The updates were made available on June 22, 2026, and are critical for maintaining system security.

Key Points: • Two critical vulnerabilities in Fedora's opkssh component were disclosed. • CVE-2026-39828 allows unauthorized command execution via SSH. • CVE-2026-39830 causes denial of service through resource leaks.