CVE-2026-55653: Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to client-side denial of service

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-06-23 · updated 2026-10-30
Weakness: CWE-415

Description

A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occurs during FIPS (Federal Information Processing Standards) mode known-group validation when the client processes attacker-controlled DH-GEX group parameters. Successful exploitation leads to client-side process termination, resulting in a Denial of Service (DoS).

Affected products

OpenSSH: all versions
Red Hat Enterprise Linux: 6.0, 7.0, 8.0, 9.0, 10.0 (and their updates)
RedHat Hardened Images: all versions
Red Hat OpenShift Container Platform 4.18: 4.0 (and their updates)
Red Hat OpenShift Container Platform 4.18: all versions
Red Hat Enterprise Linux 10: all versions — fixed in 0:9.9p1-25.el10_2
Red Hat Enterprise Linux 10.0 Extended Update Support: all versions — fixed in 0:9.9p1-7.el10_0.5
Red Hat Enterprise Linux 6: all versions
Red Hat Enterprise Linux 7: all versions
Red Hat Enterprise Linux 8: all versions — fixed in 0:8.0p1-30.el8_10
Red Hat Enterprise Linux 9: all versions — fixed in 0:9.9p1-9.el9_8
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions: all versions — fixed in 0:8.7p1-30.el9_2.13
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions: all versions — fixed in 0:8.7p1-38.el9_4.10
Red Hat Enterprise Linux 9.6 Extended Update Support: all versions — fixed in 0:8.7p1-45.el9_6.5
Red Hat Hardened Images: all versions — fixed in 10.3p1-6.hum1
Red Hat OpenShift AI 3.0: all versions — fixed in 1791818590
Red Hat OpenShift AI 3.2: all versions — fixed in 1791818602
Red Hat OpenShift AI 3.3: all versions — fixed in 1791818782
Red Hat OpenShift AI 3.4: all versions — fixed in 1791883722
Red Hat OpenShift AI 3.5: all versions — fixed in 1791819252
Red Hat OpenShift Container Platform 5: all versions
Red Hat Update Infrastructure 5: all versions — fixed in 1786435483

How to fix

Upgrade to a fixed version: Red Hat Enterprise Linux 10 0:9.9p1-25.el10_2; Red Hat Enterprise Linux 10.0 Extended Update Support 0:9.9p1-7.el10_0.5; Red Hat Enterprise Linux 8 0:8.0p1-30.el8_10; Red Hat Enterprise Linux 9 0:9.9p1-9.el9_8; Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:8.7p1-30.el9_2.13; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 0:8.7p1-38.el9_4.10; Red Hat Enterprise Linux 9.6 Extended Update Support 0:8.7p1-45.el9_6.5; Red Hat Hardened Images 10.3p1-6.hum1; Red Hat OpenShift AI 3.0 1791818590; Red Hat OpenShift AI 3.2 1791818602; Red Hat OpenShift AI 3.3 1791818782; Red Hat OpenShift AI 3.4 1791883722. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-55653 or the next vulnerability affects your stack