PT-2026-29834 · Openbsd+4 · Openssh+4

Florian Kohnhäuser · CVE-2026-35387 · Published 2026-04-02 · Updated 2026-05-28

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenSSH versions prior to 10.3

Description OpenSSH versions before 10.3 incorrectly handle ECDSA algorithms. Specifically, the software misinterprets the listing of any ECDSA algorithm in the PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms configurations as an acceptance of all ECDSA algorithms.

Recommendations Update to version 10.3 or later.

Exploit

Fix

DoS

Weakness Enumeration

CWE-670

Related Identifiers

ALSA-2026:13380

ALSA-2026:13381

ALSA-2026:13383

ALSA-2026:19069

ALSA-2026:19219

CVE-2026-35387

ECHO-3B5A-4980-C0AD

JLSEC-2026-76

OESA-2026-1963

RHSA-2026:12389

RHSA-2026:13380

RHSA-2026:13381

RHSA-2026:13383

RHSA-2026:19069

RHSA-2026:19219

USN-8222-1

Affected Products

Ibm Aix

Linuxmint

Openssh

Rocky Linux

Ubuntu

References · 61

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35387.json · Exploit
• https://errata.almalinux.org/10/ALSA-2026-19069.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-35387 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2026-13383.html · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:13381 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2026:19219 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:13380 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2026:13381 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-35387 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1963 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3497 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-35387 · Security Note
• https://ubuntu.com/security/CVE-2026-35388 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35386 · Security Note
• https://osv.dev/vulnerability/ALSA-2026:13383 · Vendor Advisory