Denial of Service Vulnerability in OpenSSH by OpenBSD
CVE-2026-60000

3.7LOW

Key Information:

Vendor

OpenBSD
Status
Openssh
Vendor
CVE Published:
8 July 2026

What is CVE-2026-60000?

A vulnerability in OpenSSH's handling of GSSAPIAuthentication allows remote attackers to consume system resources, leading to a potential denial of service. The issue arises from improper management of the MaxAuthTries setting, enabling malicious actors to exploit excessive authentication attempts to overwhelm the service. It's crucial for users of OpenSSH to upgrade to version 10.4 or later to mitigate this risk.

Affected Version(s)

OpenSSH 0 < 10.4

References

https://www.openwall.com/lists/oss-security/2026/07/06/5
https://marc.info/?l=openssh-unix-dev&m=178333966933090&w=2
https://www.openssh.org/releasenotes.html#10.4p1

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.