Use-after-free in OpenSSH - CVE-2026-73282

Vulnerability identifier: #VU146882

CSH Severity: Low

CVSS v4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-73282

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to use-after-free in the ssh client remote forwarding handling when a remote forwarding is added via the local session multiplexing socket while a remote forwarding open request is pending with the server. A remote user can trigger this race condition to cause a denial of service.

Exploitation requires access to the local session multiplexing socket while a remote forwarding open request is pending.

OpenSSH
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Ubuntu
openEuler
pam_ssh_agent_auth
openssh (Red Hat package)
openssh8.4-server-debuginfo
openssh8.4-clients
openssh8.4-server
openssh8.4
openssh8.4-common-debuginfo
openssh8.4-fips
openssh8.4-debugsource
openssh8.4-helpers-debuginfo
openssh8.4-clients-debuginfo
openssh8.4-helpers
openssh8.4-common
openssh-help
openssh-server
openssh-keycat
openssh-debugsource
openssh-debuginfo
openssh-clients
openssh-askpass
openssh
openssh (Ubuntu package)

Install security update from vendor's website.

OpenSSH - update to 10.5p1
pam_ssh_agent_auth - update to 0.10.4-5.23
openssh (Red Hat package) - addressed in versions 8.0p1-33.el8_10, 9.9p1-27.el10_2
openssh8.4-server-debuginfo - update to 8.4p1-8.27.1
openssh8.4-clients - update to 8.4p1-8.27.1
openssh8.4-server - update to 8.4p1-8.27.1
openssh8.4 - update to 8.4p1-8.27.1
openssh8.4-common-debuginfo - update to 8.4p1-8.27.1
openssh8.4-fips - update to 8.4p1-8.27.1
openssh8.4-debugsource - update to 8.4p1-8.27.1
openssh8.4-helpers-debuginfo - update to 8.4p1-8.27.1
openssh8.4-clients-debuginfo - update to 8.4p1-8.27.1
openssh8.4-helpers - update to 8.4p1-8.27.1
openssh8.4-common - update to 8.4p1-8.27.1
openssh-help - update to 9.6p1-23
openssh-server - update to 9.6p1-23
openssh-keycat - update to 9.6p1-23
openssh-debugsource - update to 9.6p1-23
openssh-debuginfo - update to 9.6p1-23
openssh-clients - update to 9.6p1-23
openssh-askpass - update to 9.6p1-23
openssh - update to 9.6p1-23
openssh (Ubuntu package) - addressed in versions 1:6.6p1-2ubuntu2.13+esm4, 1:7.2p2-4ubuntu2.10+esm10, 1:7.6p1-4ubuntu0.7+esm6, 1:8.2p1-4ubuntu0.13+esm3, 1:8.9p1-3ubuntu0.17, 1:9.6p1-3ubuntu13.19, 1:10.2p1-2ubuntu3.6

• https://www.openwall.com/lists/oss-security/2026/08/12/1
• https://www.openssh.org/txt/release-10.5

• Multiple vulnerabilities in OpenSSH
• Ubuntu update for openssh
• openEuler 24.03 LTS SP3 update for openssh
• Red Hat Enterprise Linux 10 update for openssh
• Red Hat Enterprise Linux 8 update for openssh
• Ubuntu update for openssh
• SUSE update for openssh8.4