CVE-2026-55653

Published: Jun 23, 2026Modified: Jul 8, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occurs during FIPS (Federal Information Processing Standards) mode known-group validation when the client processes attacker-controlled DH-GEX group parameters. Successful exploitation leads to client-side process termination, resulting in a Denial of Service (DoS).

Affected (8)

Products: Openbsd: Openssh · Redhat: Enterprise Linux, Hardened Images, Openshift Container Platform

1 product

3 products

Openshift Container Platform

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Openbsd Openssh	All versions
Redhat Enterprise Linux	Version 10.0
Redhat Enterprise Linux	Version 6.0
Redhat Enterprise Linux	Version 7.0
Redhat Enterprise Linux	Version 8.0
Redhat Enterprise Linux	Version 9.0
Redhat Hardened Images	All versions
Redhat Openshift Container Platform	Version 4.0

Related CWEs

CWE-415

Double Free

The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.

References (3)

https://access.redhat.com/errata/RHSA-2026:36759

Source: secalert@redhat.com

https://access.redhat.com/security/cve/CVE-2026-55653

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2462351

Source: secalert@redhat.com

ExploitIssue TrackingVendor Advisory

Timeline

No history available yet.