CVE-2026-55653Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to client-side denial of service

Description

A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occurs during FIPS (Federal Information Processing Standards) mode known-group validation when the client processes attacker-controlled DH-GEX group parameters. Successful exploitation leads to client-side process termination, resulting in a Denial of Service (DoS).

Timeline

Scores

EPSS (exploitation in 30 days)

0.53% · top 55% of all CVEs (14 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.3.

Affected products

• Red Hat · Red Hat Enterprise Linux 10

  • unaffected 0:9.9p1-25.el10_2 – < *

• Red Hat · Red Hat Enterprise Linux 10.0 Extended Update Support

  • unaffected 0:9.9p1-7.el10_0.5 – < *

• Red Hat · Red Hat Enterprise Linux 8

  • unaffected 0:8.0p1-30.el8_10 – < *

• Red Hat · Red Hat Enterprise Linux 8

  • unaffected 0:8.0p1-30.el8_10 – < *

• Red Hat · Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

  • unaffected 0:8.0p1-7.el8_4.3 – < *

• Red Hat · Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

  • unaffected 0:8.0p1-7.el8_4.3 – < *

• Red Hat · Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support

  • unaffected 0:8.0p1-15.el8_6.6 – < *

• Red Hat · Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

  • unaffected 0:8.0p1-15.el8_6.6 – < *

• Red Hat · Red Hat Enterprise Linux 9

  • unaffected 0:9.9p1-9.el9_8 – < *

• Red Hat · Red Hat Enterprise Linux 9

  • unaffected 0:9.9p1-9.el9_8 – < *

• Red Hat · Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

  • unaffected 0:8.7p1-30.el9_2.13 – < *

• Red Hat · Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

  • unaffected 0:8.7p1-38.el9_4.10 – < *

• Red Hat · Red Hat Enterprise Linux 9.6 Extended Update Support

  • unaffected 0:8.7p1-45.el9_6.5 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.13

  • unaffected 413.92.202611041925-0 – < *

• Red Hat · Red Hat Hardened Images

  • unaffected 10.3p1-6.hum1 – < *

• Red Hat · Red Hat OpenShift AI 3.0

  • unaffected 1791818590 – < *

• Red Hat · Red Hat OpenShift AI 3.0

  • unaffected 1791818589 – < *

• Red Hat · Red Hat OpenShift AI 3.0

  • unaffected 1791818505 – < *

• Red Hat · Red Hat OpenShift AI 3.0

  • unaffected 1791818496 – < *

• Red Hat · Red Hat OpenShift AI 3.0

  • unaffected 1791818502 – < *

• Red Hat · Red Hat OpenShift AI 3.0

  • unaffected 1793042072 – < *

• Red Hat · Red Hat OpenShift AI 3.2

  • unaffected 1791818602 – < *

• Red Hat · Red Hat OpenShift AI 3.2

  • unaffected 1791818598 – < *

• Red Hat · Red Hat OpenShift AI 3.2

  • unaffected 1791818512 – < *

• Red Hat · Red Hat OpenShift AI 3.2

  • unaffected 1791818587 – < *

• Red Hat · Red Hat OpenShift AI 3.2

  • unaffected 1791818778 – < *

• Red Hat · Red Hat OpenShift AI 3.2

  • unaffected 1791818512 – < *

• Red Hat · Red Hat OpenShift AI 3.3

  • unaffected 1791818782 – < *

• Red Hat · Red Hat OpenShift AI 3.3

  • unaffected 1791818782 – < *

• Red Hat · Red Hat OpenShift AI 3.3

  • unaffected 1791818627 – < *

• Red Hat · Red Hat OpenShift AI 3.3

  • unaffected 1791818790 – < *

• Red Hat · Red Hat OpenShift AI 3.3

  • unaffected 1791818874 – < *

• Red Hat · Red Hat OpenShift AI 3.3

  • unaffected 1791818792 – < *

• Red Hat · Red Hat OpenShift AI 3.3

  • unaffected 1791818662 – < *

• Red Hat · Red Hat OpenShift AI 3.3

  • unaffected 1791818877 – < *

• Red Hat · Red Hat OpenShift AI 3.4

  • unaffected 1791883722 – < *

• Red Hat · Red Hat OpenShift AI 3.4

  • unaffected 1791881612 – < *

• Red Hat · Red Hat OpenShift AI 3.4

  • unaffected 1791885618 – < *

• Red Hat · Red Hat OpenShift AI 3.4

  • unaffected 1791881487 – < *

• Red Hat · Red Hat OpenShift AI 3.4

  • unaffected 1791881732 – < *

• Red Hat · Red Hat OpenShift AI 3.4

  • unaffected 1791883315 – < *

• Red Hat · Red Hat OpenShift AI 3.4

  • unaffected 1791881486 – < *

• Red Hat · Red Hat OpenShift AI 3.4

  • unaffected 1791881769 – < *

• Red Hat · Red Hat OpenShift AI 3.4

  • unaffected 1791885505 – < *

• Red Hat · Red Hat OpenShift AI 3.5

  • unaffected 1791819252 – < *

• Red Hat · Red Hat OpenShift AI 3.5

  • unaffected 1791818749 – < *

• Red Hat · Red Hat OpenShift AI 3.5

  • unaffected 1791819206 – < *

• Red Hat · Red Hat OpenShift AI 3.5

  • unaffected 1791818979 – < *

• Red Hat · Red Hat OpenShift AI 3.5

  • unaffected 1791819123 – < *

• Red Hat · Red Hat OpenShift AI 3.5

  • unaffected 1791818901 – < *

• Red Hat · Red Hat OpenShift AI 3.5

  • unaffected 1791820333 – < *

• Red Hat · Red Hat OpenShift AI 3.5

  • unaffected 1791819495 – < *

• Red Hat · Red Hat OpenShift AI 3.5

  • unaffected 1791819104 – < *

• Red Hat · Red Hat Update Infrastructure 5

  • unaffected 1786435483 – < *

• Red Hat · Red Hat Update Infrastructure 5

  • unaffected 1786533529 – < *

• Red Hat · Red Hat Update Infrastructure 5

  • unaffected 1787135742 – < *

• Red Hat · Red Hat Update Infrastructure 5

  • unaffected 1787241260 – < *

• Red Hat · Red Hat Enterprise Linux 6

  All versions: affected

• Red Hat · Red Hat Enterprise Linux 7

  All versions: affected

• Red Hat · Red Hat OpenShift Container Platform 4

  All versions: affected

• Red Hat · Red Hat OpenShift Container Platform 5

  All versions: affected

What to do

Workaround: To mitigate this issue, OpenSSH clients operating in FIPS mode should avoid negotiating the `diffie-hellman-group-exchange-sha256` key exchange algorithm. This can be achieved by explicitly listing allowed key exchange algorithms in the client's SSH configuration file (e.g., `/etc/ssh/ssh_config` or `~/.ssh/config`), ensuring `diffie-hellman-group-exchange-sha256` is *not* included. For example, to use a subset of common algorithms, you might configure: ``` KexAlgorithms [email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1 ``` (Note: The above example `KexAlgorithms` list is illustrative and should be adjusted based on your environment's security requirements.) Additionally, avoid using non-fatal client flows, such as `ssh-keyscan`, against untrusted SSH servers while FIPS mode is enabled. Changes to `ssh_config` will take effect for new SSH connections.

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2026-38412 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-55653](https://cveledger.app/badge/CVE-2026-55653.svg)](https://cveledger.app/cve/CVE-2026-55653)

Record last updated 12 Nov 2026, 10:49 UTC.