CVE-2026-55654Openssh: heap out-of-bounds read in red hat enterprise linux versions of openssh gssapi indicator cleanup due to missing null sentinel termination

Description

A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI (Generic Security Service Application Programming Interface) indicators when a trailing NULL termination is missing in the auth-indicators array. A remote attacker, under specific configurations involving GSSAPI authentication and a Kerberos environment, could exploit this to cause the SSH authentication path to crash or abort. This leads to a denial of service (DoS), impacting the availability of the SSH service.

Timeline

Scores

EPSS (exploitation in 30 days)

0.65% · top 48% of all CVEs (13 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 3.7.

Affected products

• Red Hat · Red Hat Enterprise Linux 10

  • unaffected 0:9.9p1-25.el10_2 – < *

• Red Hat · Red Hat Enterprise Linux 9

  • unaffected 0:9.9p1-9.el9_8 – < *

• Red Hat · Red Hat Enterprise Linux 9

  • unaffected 0:9.9p1-9.el9_8 – < *

• Red Hat · Red Hat Hardened Images

  • unaffected 10.3p1-6.hum1 – < *

• Red Hat · Red Hat Update Infrastructure 5

  • unaffected 1786435483 – < *

• Red Hat · Red Hat Update Infrastructure 5

  • unaffected 1786533529 – < *

• Red Hat · Red Hat Update Infrastructure 5

  • unaffected 1787135742 – < *

• Red Hat · Red Hat Update Infrastructure 5

  • unaffected 1787241260 – < *

• Red Hat · Red Hat Enterprise Linux 6

  All versions: unaffected

• Red Hat · Red Hat Enterprise Linux 7

  All versions: unaffected

• Red Hat · Red Hat Enterprise Linux 8

  All versions: unaffected

• Red Hat · Red Hat OpenShift Container Platform 4

  All versions: affected

• Red Hat · Red Hat OpenShift Container Platform 4

  All versions: affected

• Red Hat · Red Hat OpenShift Container Platform 5

  All versions: affected

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2026-38414 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-55654](https://cveledger.app/badge/CVE-2026-55654.svg)](https://cveledger.app/cve/CVE-2026-55654)

Record last updated 6 Nov 2026, 19:07 UTC.