CVE-2026-3497
Linux OpenSSH GSSAPI Memory Corruption
Description
Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux distributions and does not affect the OpenSSH upstream project itself. The usage of sshpkt_disconnect() on an error, which does not terminate the process, allows an attacker to send an unexpected GSSAPI message type during the GSSAPI key exchange to the server, which will call the underlying function and continue the execution of the program without setting the related connection variables. As the variables are not initialized to NULL the code later accesses those uninitialized variables, accessing random memory, which could lead to undefined behavior. The recommended workaround is to use ssh_packet_disconnect() instead, which does terminate the process. The impact of the vulnerability depends heavily on the compiler flag hardening configuration.
INFO
Published Date :
March 12, 2026, 7:16 p.m.
Last Modified :
March 18, 2026, 7:16 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
Affected Products
The following products are affected by CVE-2026-3497
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 4.0 | LOW | cc1ad9ee-3454-478d-9317-d3e869d708bc | ||||
| CVSS 4.0 | MEDIUM | [email protected] |
Solution
- Apply distribution-specific security patches for OpenSSH GSSAPI.
- Review and apply suggested workaround using ssh_packet_disconnect().
- Consider compiler hardening flags to mitigate impact.
- Update OpenSSH to a patched version.
Public PoC/Exploit Available at Github
CVE-2026-3497 has a 1 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-3497.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-3497 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-3497
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Open Source Security Tool
Python
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-3497 vulnerability anywhere in the article.
-
Daily CyberSecurity
OpenSSH 10.3 Patches Command Execution and “scp” Privilege Escalation
In the critical infrastructure of the internet, OpenSSH stands as one of the most vital gatekeepers for secure remote access. However, even the most trusted tools require constant refinement. A series ... Read more
-
CybersecurityNews
OpenSSH GSSAPI Vulnerability Allow an Attacker to Crash SSH Child Processes
A significant vulnerability in the GSSAPI Key Exchange patch was applied by numerous Linux distributions on top of their OpenSSH packages. The flaw, tracked as CVE-2026-3497, was uncovered by security ... Read more
-
Daily CyberSecurity
A Single Line of Code: Pre-Auth OpenSSH Flaw Exposes Ubuntu and Debian Servers
A flaw has been found in the machinery of OpenSSH. Security researcher Jeremy Brown recently uncovered a critical vulnerability lurking within the GSSAPI Key Exchange patch, a popular modification man ... Read more
The following table lists the changes that have been made to the
CVE-2026-3497 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Mar. 18, 2026
Action Type Old Value New Value Added Reference http://www.openwall.com/lists/oss-security/2026/03/18/7 -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Mar. 18, 2026
Action Type Old Value New Value Added Reference http://www.openwall.com/lists/oss-security/2026/03/18/5 -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Mar. 18, 2026
Action Type Old Value New Value Added Reference http://www.openwall.com/lists/oss-security/2026/03/18/4 -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Mar. 18, 2026
Action Type Old Value New Value Added Reference http://www.openwall.com/lists/oss-security/2026/03/18/2 -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Mar. 16, 2026
Action Type Old Value New Value Added Reference http://www.openwall.com/lists/oss-security/2026/03/14/3 Added Reference http://www.openwall.com/lists/oss-security/2026/03/14/4 -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Mar. 12, 2026
Action Type Old Value New Value Added Reference http://www.openwall.com/lists/oss-security/2026/03/12/3 -
New CVE Received by [email protected]
Mar. 12, 2026
Action Type Old Value New Value Added Description Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux distributions and does not affect the OpenSSH upstream project itself. The usage of sshpkt_disconnect() on an error, which does not terminate the process, allows an attacker to send an unexpected GSSAPI message type during the GSSAPI key exchange to the server, which will call the underlying function and continue the execution of the program without setting the related connection variables. As the variables are not initialized to NULL the code later accesses those uninitialized variables, accessing random memory, which could lead to undefined behavior. The recommended workaround is to use ssh_packet_disconnect() instead, which does terminate the process. The impact of the vulnerability depends heavily on the compiler flag hardening configuration. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-908 Added Reference https://ubuntu.com/security/CVE-2026-3497 Added Reference https://www.openwall.com/lists/oss-security/2026/03/12/3