CVE and update status of the FreeBSD ports tree3,637 unaddressed CVEs in 719 portsAll times are CET
CVE details

CVE-2026-123158

sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.

Score
8.1 high
Published
2026-11-05
Links
NVD · cve.org · Report wrong data

Matched ports (3)

PortPackageVersionStatusMaintainer
security/openssh-portableopenssh-portable10.6.p1,1unaddressedbdrewery@FreeBSD.org
security/openssh-portableopenssh-portable-gssapi10.6.p1,1unaddressedbdrewery@FreeBSD.org
security/openssh-portableopenssh-portable-hpn10.6.p1,1unaddressedbdrewery@FreeBSD.org

Template for a VuXML entry

Check the content

Check the version numbers before you commit this entry. Some ports share an entry in the CVE database with another port, such as sqlite2 and sqlite3. The version shown here may then be one that never existed for this port.

Not finished: this entry still needs a checked upper bound for every package. Do not commit it as it is.

Ranges per package from the CVE rows that match this port, in pkg notation with the port's epoch and revision, every bound checked with pkg; one range per epoch the port actually had. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>openssh-portable -- FIXME</topic>
    <affects>
      <package>
	<name>openssh-portable</name>
	<name>openssh-portable-gssapi</name>
	<name>openssh-portable-hpn</name>
	<!-- another range of the CVE record still lists 10.6p2 as affected (check the branches) -->
	<range><lt>FIXME</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>CVE-2026-123158: sshd in OpenSSH before 10.6p2 on Linux, when musl
	  libc is used without PAM, lacks a workaround for a password
	  authentication bypass (related to misinterpretation of whether a
	  string is intended to be a password hash). For some configurations
	  of accounts, any password between 256 and 1024 characters succeeds.
	  An example of a platform using musl libc without PAM is Alpine
	  Linux.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-123158</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-123158</url>
    </references>
    <dates>
      <discovery>2026-11-05</discovery>
      <entry>2026-11-05</entry>
    </dates>
  </vuln>