Linuxsecurity Fedora OpenSSH Update Addresses CVE-2026-3497 Information Disclosure Vulnerability
Article Content
- •CVE-2026-3497 addresses information disclosure and DoS risks in OpenSSH.
- •Fedora 42 and 43 users are urged to update their systems immediately.
- •The vulnerability was published on March 12, 2026, and patches were released on March 18, 2026.
A major update for OpenSSH in Fedora 43 and an important fix for Fedora 42 were released to address CVE-2026-3497, which involves information disclosure or denial of service due to uninitialized variables in gssapi-keyex. The vulnerability affects both Fedora 42 and Fedora 43 systems, potentially allowing attackers to exploit the issue if not patched. The updates were published on March 18, 2026, and are available for installation via the 'dnf' update program. Users are advised to upgrade to the latest versions to mitigate the risks associated with this vulnerability. The specific versions affected include OpenSSH 10.0p1-7 for Fedora 43 and 9.9p1-13 for Fedora 42. The vulnerability was published on March 12, 2026, and is categorized as a medium severity issue. Both articles emphasize the importance of applying the updates promptly to ensure system security.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (3)
Following this threat?
Track Fedora and CVE-2026-3497 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host… 
Critical SQL Injection Zero-Day in Arista VeloCloud Orchestrator Exploited Arista Networks has patched a critical zero-day vulnerability (CVE-2026-114625) in its VeloCloud Orchestrator (VCO) that is actively being exploited. The flaw allows authenticated users, even those with basic privileges, to escalate their access to superuser status via a low-complexity SQL injection attack. This…