openssh | Snyk

Direct Vulnerabilities

Known vulnerabilities in the openssh package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
L Least Privilege Violation	<1:10.6p1-1
L Access of Resource Using Incompatible Type ('Type Confusion')	<1:10.6p1-1
M Always-Incorrect Control Flow Implementation	<1:10.6p1-1
L Improper Handling of Highly Compressed Data (Data Amplification)	<1:10.6p1-1
L Off-by-one Error	<1:10.6p1-1
H Resource Injection	<1:10.6p1-1
L Covert Channel	<1:10.6p1-1
H Incorrect Resource Transfer Between Spheres	<1:10.6p1-1
H Incorrect Resource Transfer Between Spheres	<1:10.6p1-1
M Directory Traversal	<1:10.6p1-1
L Always-Incorrect Control Flow Implementation	<1:10.5p1-1
L Use After Free	<1:10.5p1-1
L Incorrect Resource Transfer Between Spheres	<1:10.5p1-1
L Use After Free	<1:10.4p1-1
L Allocation of Resources Without Limits or Throttling	<1:10.4p1-1
L Allocation of Resources Without Limits or Throttling	<1:10.4p1-1
L Use of Less Trusted Source	<1:10.4p1-1
L Improper Following of Specification by Caller	<1:10.4p1-1
L Improper Validation of Specified Quantity in Input	<1:10.4p1-1
L Directory Traversal	<1:10.4p1-1
L Directory Traversal	<1:10.4p1-1
M Improper Restriction of Communication Channel to Intended Endpoints	<1:10.4p1-1+e2
L Out-of-bounds Read	<1:10.4p1-1+e1
H Always-Incorrect Control Flow Implementation	<1:9.2p1-2+deb12u10
L Unprotected Alternate Channel	<1:9.2p1-2+deb12u10
M Always-Incorrect Control Flow Implementation	<1:9.2p1-2+deb12u10
H Incorrect Behavior Order	<1:9.2p1-2+deb12u10
H Improper Preservation of Permissions	<1:9.2p1-2+deb12u10
L Improper Neutralization of Null Byte or NUL Character	<1:9.2p1-2+deb12u8
L Failure to Sanitize Special Element	<1:9.2p1-2+deb12u8
L CVE-2025-32728	<1:9.2p1-2+deb12u6
M Detection of Error Condition Without Action	<1:9.2p1-2+deb12u5
H CVE-2023-51767	<1:9.2p1-2+deb12u6
M OS Command Injection	<1:9.2p1-2+deb12u2
M CVE-2023-51384	<1:9.2p1-2+deb12u2
M Improper Validation of Integrity Check Value	<1:9.2p1-2+deb12u2
C Unquoted Search Path or Element	<1:9.2p1-2+deb12u1
C CVE-2023-28531	<1:9.2p1-2+deb12u2
M Double Free	<1:9.2p1-1
H CVE-2021-41617	<1:8.7p1-1
L Improper Authentication	<1:8.9p1-1
H Double Free	<1:8.4p1-5
H OS Command Injection	<1:9.2p1-2+deb12u6
M Information Exposure	<1:9.2p1-2+deb12u6
H Improper Input Validation	<1:8.3p1-1
H Integer Overflow or Wraparound	<1:8.1p1-1
M Incorrect Authorization	<1:7.9p1-5
M Information Exposure	<1:9.2p1-2+deb12u6
M Race Condition	<1:7.7p1-4
M Incorrect Permission Assignment for Critical Resource	<1:7.6p1-1
M CVE-2016-20012	<1:9.2p1-2+deb12u6
H NULL Pointer Dereference	<1:7.4p1-1
H Out-of-Bounds	<1:7.4p1-1
M Key Management Errors	<1:7.4p1-1
H Access Restriction Bypass	<1:7.4p1-1
H Untrusted Search Path	<1:7.4p1-1
H CVE-2026-3497	<1:9.2p1-2+deb12u9
H Race Condition	<1:9.2p1-2+deb12u3
M Directory Traversal	<1:7.9p1-9
M Inappropriate Encoding for Output Context	<1:9.2p1-2+deb12u6
M Improper Encoding or Escaping of Output	<1:7.9p1-6
H Resource Management Errors	<1:7.3p1-2
H Improper Input Validation	<1:7.3p1-1
M Information Exposure	<1:7.2p2-6
M CVE-2016-3115	<1:7.2p2-1
C Improper Authentication	<1:7.2p1-1
M Out-of-Bounds	<1:7.1p2-1
H Out-of-Bounds	<1:7.1p2-1
M Information Exposure	<1:7.1p2-1
H Access Restriction Bypass	<1:7.2p2-3
H Access Restriction Bypass	<1:6.9p1-1
L Improper Input Validation	<1:6.9p1-1
H Access Restriction Bypass	<1:6.9p1-1
M Access Restriction Bypass	<1:6.9p1-1
M Improper Input Validation	<1:6.6p1-1
M Access Restriction Bypass	<1:6.6p1-1
M Access Restriction Bypass	<1:6.4p1-1
L Credentials Management	<1:5.6p1-1
L Numeric Errors	<1:5.9p1-1
M Access Restriction Bypass	<1:5.8p1-2
M CVE-2010-5107	<1:6.0p1-4
L Information Exposure	<1:5.1p1-5
M Access Restriction Bypass	<1:4.6p1-1
M Access Restriction Bypass	<1:9.2p1-2+deb12u6
M Cryptographic Issues	<1:4.7p1-10
M Access Restriction Bypass	<1:4.7p1-8
H Access Restriction Bypass	<1:4.7p1-5
H Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)	<4.7p1-9
H Improper Input Validation	<1:4.7p1-1
M Information Exposure	<1:9.2p1-2+deb12u6
M Improper Authentication	<1:9.2p1-2+deb12u6
H CVE-2006-5794	<1:4.3p2-6
M CVE-2006-5052	<1:4.6p1-1
H Double Free	<1:4.6p1-1
M CVE-2006-4925	<1:5.1p1-5
H Resource Management Errors	<1:4.3p2-4
M Resource Management Errors	<1:3.8.1p1-4
M CVE-2006-0225	<1:4.3p2-1
M CVE-2005-2798	<1:4.2p1-1
M CVE-2005-2797	<1:4.2p1-1
L Credentials Management	<1:4.0p1-1
M Configuration	<1:3.6p1-1
M CVE-2004-2069	<1:3.8p1
M Directory Traversal	<1:3.9p1-1
H Race Condition	<1:3.8.1p1-8.sarge.4
H CVE-2003-0787	<1:3.7.1p2
C CVE-2003-0786	<1:3.7.1p2
H CVE-2003-0695	<1:3.7.1
C CVE-2003-0693	<1:3.6.1p2-6.0
H CVE-2003-0682	<1:3.6.1p2-9
H CVE-2003-0386	<1:3.8p1-1
M Information Exposure	<1:3.8.1p1-8.sarge.4
H CVE-2002-0765	<1:3.3p1-0.0woody1
C CVE-2002-0640	<1:3.4
C Integer Overflow or Wraparound	<1:3.4
H CVE-2001-1507	<1:3.0.1
H CVE-2001-1459	<1:3.0.1p1-1
M CVE-2000-0992	<1:3.9p1-1

Vulnerability

Vulnerable Version

Least Privilege Violation

<1:10.6p1-1