CVE-2026-3497

What it is

Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux distributions and does not affect the OpenSSH upstream project itself. The usage of sshpkt_disconnect() on an error, which does not terminate the process, allows an attacker to send an unexpected GSSAPI message type during the GSSAPI key exchange to the server, which will call the underlying function and continue the execution of the program without setting the related connection variables. As the variables are not initialized to NULL the code later accesses those uninitialized variables, accessing random memory, which could lead to undefined behavior. The recommended workaround is to use ssh_packet_disconnect() instead, which does terminate the process. The impact of the vulnerability depends heavily on the compiler flag hardening configuration.

At a glance

Exploitability

Can be exploited over the network without logging in. Limited direct impact.

Exploit odds

2.3% chance of exploitation in the next 30 days (EPSS).

Fix

No patch or advisory is linked yet. Look at mitigations or restrict exposure.

Timeline

1. 2026-03-12 19:16 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-10-15 02:19 UTC Last updatedMost recent change to the record

Details

Published

2026-03-12 19:16 UTC

Last modified

2026-10-15 02:19 UTC

Exploit probability

2.3% · EPSS, next 30 days

Weakness

CWE-908

Record status

Modified

Affected

• Canonical Ubuntu Linux 25.10
• Openbsd OpenSSH
• Canonical Ubuntu Linux 20.04
• Canonical Ubuntu Linux 22.04
• Canonical Ubuntu Linux 24.04
• Debian Linux 11.0
• Redhat Enterprise Linux 8.0
• Redhat Enterprise Linux 9.0

Attack profile CVSS 4.0 · 6.9

Attack vector

Network

Complexity

Low

Attack requirements

None

Privileges needed

None

User interaction

None

Confidentiality

None

Integrity

Low

Availability

Low