CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
Port details

security/openssh-portable 10.6.p1,1

The portable version of OpenBSD's OpenSSH

0
unaddressed
0
VuXML only
29
fixed
9
open problem reports

Port info

Maintainer
bdrewery@FreeBSD.org
Packages
latest: openssh-portable 10.6.p1,1, openssh-portable-gssapi 10.6.p1,1, openssh-portable-hpn 10.6.p1,1
Upstream
Higher version available: 18.12.0
Last update
to 10.6.p1,1 · 3ae2665579
Quarterly
2026Q4: openssh-portable 10.6.p1,1, openssh-portable-hpn 10.6.p1,1 · last MFH a6d0a08dd7
Formerly
security/openssh-portable-devel until 2016-02-29, security/hpn-ssh until 2006-03-15
WWW
https://www.openssh.com/portable.html
Links
cgit · VuXML

Install

Package
# pkg install openssh-portable
# pkg install openssh-portable-gssapi
# pkg install openssh-portable-hpn
installs openssh-portable 10.6.p1,1, openssh-portable-gssapi 10.6.p1,1, openssh-portable-hpn 10.6.p1,1 from latest; from quarterly (2026Q4) openssh-portable 10.6.p1,1, openssh-portable-hpn 10.6.p1,1
Port
# cd /usr/ports/security/openssh-portable && make install clean
# make -C /usr/ports/security/openssh-portable config  # change options first
Size
1.2 MiB download · 8.2 MiB installed
Depends on
devel/libedit 3.1.20260512,1, dns/ldns 1.9.2, security/libfido2 1.17.0
License
OPENSSH
Options
7 of 14 on in the package: BLOCKLISTD DOCS FIDO_U2F LDNS LIBEDIT PAM TCP_WRAPPERS
Show the 7 options that are off
BSM HEIMDAL HEIMDAL_BASE HPN KERB_GSSAPI MIT NONECIPHER
pkg-message
Shown after installing
To enable this port, add openssh_enable="YES" in your rc.conf. To
prevent conflict with openssh in the base system add sshd_enable="NO"
in your rc.conf. Also you can configure openssh at another TCP port (via
sshd_config 'Port' and 'Listen' options or via 'openssh_flags'
variable in rc.conf) and run it in same time with base sshd.

'PermitRootLogin no' is the default for the OpenSSH port.
This now matches the PermitRootLogin configuration of OpenSSH in
the base system.  Please be aware of this when upgrading your
OpenSSH port, and if truly necessary, re-enable remote root login
by readjusting this option in your sshd_config.

Users are encouraged to create single-purpose users with ssh keys, disable
Password authentication by setting 'PasswordAuthentication no' and
'ChallengeResponseAuthentication no', and to define very narrow sudo
privileges instead of using root for automated tasks.
Note
Size, dependencies, options and messages are those of openssh-portable.

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 1610.6.p1,110.6.p1,1–
FreeBSD 1510.6.p1,110.6.p1,1–
FreeBSD 1410.6.p1,110.6.p1,110.6.p1,1

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 1510.6.p1,110.6.p1,1–
FreeBSD 1410.6.p1,110.6.p1,110.6.p1,1

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 10.6.p1,1.

Fixed (29)

Show 29 fixed
VuXML entries whose affected range the packaged version has left, plus CVEs from the last 90 days that this version is already past (fixed by update).
CVECVSSPublishedDescription
CVE-2026-1065856.52026-10-06In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data.
CVE-2026-1065524.22026-10-06In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.
CVE-2026-1065823.72026-10-06In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the Streams" findings.
CVE-2026-1065873.62026-10-06In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.
CVE-2026-1065883.12026-10-06In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is potentially unexpected.
CVE-2026-1065892.92026-10-06In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges. This is related to the G…
CVE-2026-1065832.52026-10-07In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.
CVE-2026-1065842.52026-10-06In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effe…
CVE-2026-1065862.52026-10-06In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than …
CVE-2026-1065532.22026-10-06In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.
CVE-2026-1065552.22026-10-06In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.

Problem reports (9) · open in Bugzilla, most recently changed first

PRSummaryStatusChanged
298530maintainer-feedback? security/openssh-portable: new GSSAPIKeyExchange patchNew2026-10-22
297915maintainer-feedback? security/openssh-portable: Catch up with base patchesNew2026-08-25
282222maintainer-feedback? security/openssh-portable: Add option to build without OpenSSLNew2026-08-11
297078maintainer-feedback? security/openssh-portable: pre-key-exchange crashNew2026-07-30
289965maintainer-feedback? security/openssh-portable: doesn't appear to depend on ports opensslNew2026-04-26
Show all 9
PRSummaryStatusChanged
292248maintainer-feedback? security/openssh-portable: sshd-session crash on FreeBSD 15.0-RELEASE on arm64New2026-01-14
276410maintainer-feedback? security/openssh-portable: SSHFP/known_hosts issues when HPN is enabled (9.9.p1_1,1)New2025-01-15
282966maintainer-feedback? security/openssh-portable: Tiny error in sshd_config(5)New2024-11-25
272065maintainer-feedback? security/openssh-portable: Add patch for different interpretation of BADUSERNew2023-11-28

Commits (450)

Bryan Drewery (bdrewery) · 10.6.p1,1
security/openssh-portable: Update GSSAPI from latest debian patch.

Submitted by:	Garrett Wollman
PR:		298530
3ae2665579
Bryan Drewery (bdrewery) · 10.6.p1,1 MFH 2026Q4 ✓
security/openssh-portable: Update to 10.6p1

Release notes: https://www.openssh.org/txt/release-10.6
b8d0a9401e
Bryan Drewery (bdrewery) · 10.5.p1_1,1
security/openssh-portable: Use blocklist

Starting from FreeBSD version 1500000, prefer the new blocklist
nomenclature.

Once older versions are no longer supported, we should use blocklist
exclusively.

This also fixes a regression with UseBlacklist not being properly
read from the config in commit 516c0db3f73b for the 10.4 update.

PR:		294082
7a946c37c5
Bryan Drewery (bdrewery) · 10.5.p1,1
security/openssh-portable: Update to 10.5p1

Release notes: https://www.openssh.org/txt/release-10.5
b6e1767f0a
Bryan Drewery (bdrewery) · 10.4.p1,1
security/openssh-portable: Update to 10.4p1

Deprecate the HPN patch. It was removed in base in 2016. It has not
matched the upstream patch in many years, which has been renamed
to "hpn-ssh". Bringing it back as a separate port could make sense
but won't be done in this port.

Release notes: https://www.openssh.org/txt/release-10.4
516c0db3f7
Bryan Drewery (bdrewery) · 10.3.p1,1
security/openssh-portable: Fix blacklistd/HPN glue patch.

Reported by:	leres
Fixes: 899a7de9a078
294be7ad9e
Bryan Drewery (bdrewery) · 10.3.p1,1
security/openssh-portable: Update to 10.3p1

Release notes: https://www.openssh.org/txt/release-10.3
899a7de9a0
Bryan Drewery (bdrewery) · 10.2.p1_6,1
security/openssh-portable: Fix `make test`

No changes here affect the build or package.
8dc56cb5c4
Bryan Drewery (bdrewery) · 10.2.p1_6,1
security/openssh-portable: Fix PermitRootLogin default to "no"

This matches what is reported in pkg-message.

PR:		267170
Reported by:	SimpleRezo
fad4f7d3cf
Bryan Drewery (bdrewery) · 10.2.p1_5,1
security/openssh-portable: Sync some files with src.

Namely this updates some LIBWRAP behavior and updates a few incorrect
docs.

Submitted by:	jlduran
Differential Revision:	https://reviews.freebsd.org/D53273
5a1588f7fb
Bryan Drewery (bdrewery) · 10.2.p1_4,1
security/openssh-portable: Disable X11Forwarding by default.

This syncs with src and upstream.

Submitted by:	jlduran
Differential Revision:	https://reviews.freebsd.org/D53268
1c7000b1d4
Bryan Drewery (bdrewery) · 10.2.p1_3,1
security/openssh-portable: Fix NONE_CIPHER.

Tested with:
	sshd_config:
	  NoneEnabled yes

	# ssh -o NoneSwitch=yes -o NoneEnabled=yes -vv cmd...

Note that the `none` cipher is _never enabled for interactive TTY_.

PR:		292710
Submitted by:	Andre Albsmeier
069c72440f
Bryan Drewery (bdrewery) · 10.2.p1_2,1
security/openssh-portable: XMSS has been removed. Tidy up options

XMSS key support was removed in 10.1 https://www.openssh.com/txt/release-10.1
Remove option from port Makefile

PR:		290220
814bb8d173
Vladimir Druzenko (vvd) · 10.2.p1_2,1
*/*: Bump consumers of dns/ldns after update to 1.9.0

Force rebuild comsumers - upstream changed ABI without bump soname.

ldns 1.9.0 inserted LDNS_RDF_TYPE_INT64 at enum position 5, shifting
every subsequent value by +1. But port kept the shared library as
libldns.so.3.6.0 - no SONAME bump - so consumers wasn't flagged for
rebuild and still has the old 1.8.x enum constants baked in.

Example of error for opendnssec:
[adapter] error parsing RR at line 2 (Syntax error, could not parse
the RR's rdata)

PR:		291573
Sponsored by:	UNIS Labs
f9b1e7f445
Jason E. Hale (jhale) · 10.2.p1_1,1
*/*: De-orbit alias.mk

Mk/Uses/alias.mk was an attempt for compat with DPorts, but has rotted.
This feature was never documented in the PHB, so there is no work to
be done by the docs@ team.

Nothing against DragonFly, but if DPorts still needs FreeBSD 9
support, they really should work that out with upstream projects.

Ultimately, we don't need to keep carrying this outdated feature that
doesn't affect us.
14f7c29430
Jose Luis Duran (jlduran) · 10.2.p1_1,1
security/openssh-portable: Remove blocklist probe

Our version of blocklist is not async-signal safe.
Remove the probe for now.

Reviewed by:	bdrewery
Differential Revision:	https://reviews.freebsd.org/D53266
7c9b7e8add
Bryan Drewery (bdrewery) · 10.2.p1,1
security/openssh-portable: Update to 10.2p1

Changes: https://www.openssh.com/txt/release-10.2
a2f551caf6
Bryan Drewery (bdrewery) · 10.1.p1_5,1
security/openssh-portable: Sync blocklist with base, include by default.

The patch is included by default in base as well. It remains
off by default though.

Added glue for HPN patch to apply.

Reviewed By:		bdrewery
Differential Revision:	https://reviews.freebsd.org/D52880
PR:			280203
28bb20eaf6
Bryan Drewery (bdrewery) · 10.1.p1_4,1
security/openssh-portable: Fix "master" mode connection sharing with 10.1p1.

Patch taken from https://github.com/openssh/openssh-portable/commit/beae06f56e0d0a66ca535896149d5fb0b2e8a1b4.patch

PR:		290100
Reported by:	Matthew D. Fuller
8eb70f1ee3
Bryan Drewery (bdrewery) · 10.1.p1_3,1
security/openssh-portable: Update KERB_GSSAPI for 10.1p1
fd95f8bb26
Bryan Drewery (bdrewery) · 10.1.p1_2,1
security/openssh-portable: GC missed skip_dsa var.
e2ea6753b2
Bryan Drewery (bdrewery) · 10.1.p1_1,1
security/openssh-portable: Stop trying to generate DSA key.

DSA key support was removed in 10.0.
8a5ad92ecc
Bryan Drewery (bdrewery) · 10.1.p1,1
security/openssh-portable: Update to 10.1p1

Changes: https://www.openssh.com/txt/release-10.1
7d4f03d56d
Bryan Drewery (bdrewery) · 10.0.p1_2,1
security/openssh-portable: Fix gssapi build.

Debian updated their patches. Also mirror the patch while here.
8f4607278d
Kyle Evans (kevans) · 10.0.p1_2,1
security/openssh-portable: fix uidswap behavior on FreeBSD

This adds base commit 239e8c98636a757 as a patch to avoid losing our
real GID inside temporarily_use_uid()/restore_uid() blocks.  This is
scoped to the specific __FreeBSD_version along 15.0 where we re-aligned
our setgroups(2)/getgroups(2) with other platforms (no egid touching;
just supplemental groups).

Approved by:	bdrewery (maintainer, without version check)
Differential Revision:	https://reviews.freebsd.org/D51846
b8f4c93fa1
Xavier Beaudouin (kiwi) · 10.0.p1_1,1
security/openssh-portable: Add KERB_GSSAPI patch for 10.0p1

This patch unbreaks the gssapi flavor.
Bumped PORTREVISION.

Sponsored by:	Klara, Inc.
Approved by:	0mp (mentor)
Approved by:	portmgr (blanket)
Differential Revision:	https://reviews.freebsd.org/D50484
3b54d53a5a
Bryan Drewery (bdrewery) · 10.0.p1,1
security/openssh-portable: Update to 10.0p1
dde9561b3f
Bryan Drewery (bdrewery) · 9.9.p2_1,1
security/openssh-portable: LDNS: Disable default VerifyHostKeyDNS

This follows base 41ff5ea22cb95d which disabled this as the default.
d2522f4704
Bryan Drewery (bdrewery) · 9.9.p2,1
security/openssh-portable: Update to 9.9p2

Changes: https://www.openssh.com/releasenotes.html
Security:
  * Fix CVE-2025-26465 - ssh(1) in OpenSSH versions 6.8p1 to 9.9p1
    (inclusive) contained a logic error that allowed an on-path
    attacker (a.k.a MITM) to impersonate any server when the
    VerifyHostKeyDNS option is enabled. This option is off by default.

  * Fix CVE-2025-26466 - sshd(8) in OpenSSH versions 9.5p1 to 9.9p1
    (inclusive) is vulnerable to a memory/CPU denial-of-service related
    to the handling of SSH2_MSG_PING packets. This condition may be
1896ee6874
Bryan Drewery (bdrewery) · 9.9.p1_1,1
security/openssh-portable: Include ssh[d]_config.d/*.conf
96dd1bc15c
Bryan Drewery (bdrewery) · 9.9.p1,1
security/openssh-portable: Update to 9.9p1
778644b317
Mateusz Piotrowski (0mp) · 9.8.p1_1,1
security/openssh-portable: Add KERB_GSSAPI patch for 9.8p1

This patch unbreaks the gssapi flavor.

- Update the distfile location.
- Remove files/extra-patch-gssapi-auth2-gss.c. The change is already
  present in the code so there is no need to carry this extra patch any
  further.
- Add -lgssapi_krb5 to CONFIGURE_LIBS. It fixes the following build errors:

      ld: error: undefined symbol: gss_indicate_mechs
      >>> referenced by sshd.c
      >>>               sshd.o:(main)
      ld: error: undefined symbol: gss_release_oid_set
      >>> referenced by sshd.c
      >>>               sshd.o:(main)

PR:		279437
Approved by:	maintainer timeout
Sponsored by:	Klara, Inc.
09b332a715
Bryan Drewery (bdrewery) · 9.8.p1_1,1
security/openssh-portable: fix missing include for sshd.c

This patch adds a missing include for `channels.h`. It is needed, as
later in the file there is a call to `channel_set_hpn`, which is
declared in `channels.h`.

Some ISO C99 compilers may complain about implicit function declaration.
7ba88c964b
Bryan Drewery (bdrewery) · 9.8.p1,1
security/openssh-portable: Remove blacklistd chunk for FreeBSD-SA-24:08.openssh

The blacklistd patch currently is broken. Remove the chunk from
FreeBSD-SA-24:08.openssh to be sure it does not linger once the
patch is fixed.
64c0a35aaa
Bryan Drewery (bdrewery) · 9.8.p1,1
security/openssh-portable: Update to 9.8p1

Changes: https://www.openssh.com/txt/release-9.8
402562e255
Bryan Drewery (bdrewery) · 9.7.p1_2,1
security/openssh-portable: Bring in patches for recent CVES

Source:	https://lists.mindrot.org/pipermail/openssh-unix-dev/2024-July/041431.html
PR:	280068
7b31ce1eee
Bernard Spil (brnrd) · 9.7.p1_1,1
security/openssh-portable: Revert commit

* Revert changes other than the PORTREVISION bump
 * See PR 280068
6c74a768ed
Bernard Spil (brnrd) · 9.7.p1_1,1
security/vuxml: Document OpenSSH vulnerability
66a620a734
Bryan Drewery (bdrewery) · 9.7.p1,1
security/openssh-portable: Update to 9.7p1

Changes: https://www.openssh.com/txt/release-9.7
146b99934b
Yasuhiro Kimura (yasu) · 9.6.p1_2,1
security/openssh-portable: Move manpages to share/man

Approved by:	portmgr (blanket)
69c74a9674
Bryan Drewery (bdrewery) · 9.6.p1_1,1
security/openssh-portable: Fix KERB_GSSAPI build
bb65ffae9e
Bryan Drewery (bdrewery) · 9.6.p1_1,1
security/openssh-portable: Update HPN patch.

- Mark GSSAPI build as broken while here.
b3f86656fc
Bernard Spil (brnrd) · 9.6.p1_1,1
security/openssh-portable: Fix blacklistd patch
d820fcf123
Gordon Tetlow (gordon) · 9.6.p1_1,1
security/openssh-portable: Make HPN as BROKEN.
7627c9552c
Gordon Tetlow (gordon) · 9.6.p1_1,1
security/openssh-portable: Update to 9.6p1

Approved by:	bdrewery
Differential Revision:	https://reviews.freebsd.org/D43132
277b9fe50d
Xin LI (delphij) · 9.3.p2_2,1
security/openssh-portable: fix build with zlib 1.3

PR:		ports/273578
Approved by:	maintainer timeout
d839d49f92
Bernard Spil (brnrd) · 9.3.p2_1,1
www/vaultwarden-web_vault: Revert borked git add

This reverts commit 3a3fbae18157d39b68c43c590fa9e977fed9cef4.
8269bdb998
Bernard Spil (brnrd) · 9.3.p2_1,1
www/vaultwarden-web_vault: Update to 2023.8.2

PR:		274304
Approved by:	maintainer time-out
3a3fbae181
Mateusz Piotrowski (0mp) · 9.3.p2_1,1
security/openssh-portable: Fix build with KERB_GSSAPI set

PR:		273052
Reported by:	brd
Approved by:	maintainer timeout
Tested by:	wollman
Sponsored by:	Klara Inc.
3bd9ddb0b5
Bryan Drewery (bdrewery) · 9.3.p2,1
security/openssh-portable: Update to 9.3p2.

Changes:	https://www.openssh.com/txt/release-9.3p2
Security:	CVE-2023-38408
f6d0388dfe
page 1 of 9older →oldest »