Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
Loki SSH client can crash server with many rejected channels
published 23 days ago
Summary
The Loki SSH service can run out of memory if an authorized user repeatedly tries to open connections that the server refuses, eventually causing the server to stop working. When the server crashes, all users lose access. Update Loki to the latest version or apply the vendor’s patch to stop the memory buildup.
What to do
- Update cleanstart loki to version 3.7.1-r1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | loki |
< 3.7.1-r1 Fix: upgrade to 3.7.1-r1
|
Original advisory text
authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users
Security vulnerability affects the loki package. An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Timeline
Published26 Sep 2026
Updated26 Sep 2026
First seen26 Sep 2026
Sources
CLEANSTART-2026-PN24745 · OSV
Track software like this
Free during beta