PT-2026-29834 · Openbsd+3 · Openssh+3

Florian Kohnhäuser · Published 2026-04-02 · Updated 2026-05-04 · CVE-2026-35387

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenSSH versions prior to 10.3

Description OpenSSH versions before 10.3 incorrectly handle ECDSA algorithms. Specifically, the software misinterprets the listing of any ECDSA algorithm in the PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms configurations as an acceptance of all ECDSA algorithms.

Recommendations Update to version 10.3 or later.

Fix

Weakness Enumeration

CWE-670

Related Identifiers

ALSA-2026:13380

ALSA-2026:13381

ALSA-2026:13383

CVE-2026-35387

ECHO-3B5A-4980-C0AD

JLSEC-2026-76

OESA-2026-1963

USN-8222-1

Affected Products

Linuxmint

Openssh

Rocky Linux

Ubuntu

References · 48

• https://ubuntu.com/security/CVE-2026-35386 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2026-13381.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35386 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-35385 · Security Note
• https://ubuntu.com/security/CVE-2026-35414 · Vendor Advisory
• https://osv.dev/vulnerability/JLSEC-2026-76 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35388 · Security Note
• https://ubuntu.com/security/CVE-2026-35385 · Vendor Advisory
• https://errata.almalinux.org/10/ALSA-2026-13380.html · Vendor Advisory
• https://osv.dev/vulnerability/USN-8222-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:13380 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-35387 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35387 · Security Note
• https://errata.rockylinux.org/RLSA-2026:13383 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2026-13383.html · Vendor Advisory