GHSA-hpxh-vgmp-3qp6

GHSA-hpxh-vgmp-3qp6 PUBLISHED CVSS 3.0999999046325684 LOW

OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA algorithms.

Risk Scores

CVSS 3.1

3.0999999046325684

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Exploit Intelligence

package.py (github-poc)

Timeline

Apr 2, 2026 CVE Published
Apr 10, 2026 Security Advisory

References

https://nvd.nist.gov/vuln/detail/CVE-2026-35387 advisory
https://marc.info/?l=openssh-unix-dev&m=177513443901484&w=2 url
https://www.openssh.org/releasenotes.html#10.3p1 url
https://www.openwall.com/lists/oss-security/2026/04/02/3 url

Open in Interactive Console →