CVE-2026-35387: Medium severity OpenSSH OpenSSH vulnerability
OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA algorithms.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.8p1-8
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35387?
CVE-2026-35387 is rated as a high-severity vulnerability due to its potential impact on cryptographic security.
How do I fix CVE-2026-35387?
To remediate CVE-2026-35387, upgrade OpenSSH to version 10.3 or later.
What should I know about the ECDSA algorithms in CVE-2026-35387?
CVE-2026-35387 indicates that unintended ECDSA algorithms can be used if they are improperly listed in configuration settings.
What versions of OpenSSH are affected by CVE-2026-35387?
OpenSSH versions prior to 10.3 are affected by CVE-2026-35387.
Is there a workaround for CVE-2026-35387?
A temporary workaround for CVE-2026-35387 is to review and adjust the PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms settings.