CVE-2026-73282Medium· 4.8▾ SunlitIn ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 26.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.
openssh < 10.5Upgrade past the affected range:
openssh 10.5Connected by shared product, vendor, weakness, or advisory.
CVE-2026-73283Low· 2.5In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.
CVE-2026-73281Low· 3.5In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys
CVE-2026-110923Medium· 6.5A flaw was found in OpenSSH
CVE-2026-110925Medium· 5.4A flaw was found in OpenSSH
CVE-2026-110926Medium· 5.3A flaw was found in OpenSSH
CVE-2023-51767High· 7.0OpenSSH through 10.0, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer value of authenticated in mm_answer_authpassword does not resist flips of a single bit