Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.3
CVE-2026-106584: OpenSSH certificates can show wrong expiration dates
CVE-2026-106584 · published 12 days ago
Summary
Versions of OpenSSH released before 10.6 may calculate certificate expiration times incorrectly because of daylight‑saving time handling. This can cause certificates to appear expired too early or remain valid longer, especially for users in certain Antarctic regions. Upgrade OpenSSH to the latest version to ensure accurate certificate timing.
What to do
- Update bellsoft openssh to version 9.1_p1-r16.
- Update bellsoft openssh to version 10.6_p1-r0.
- Update openssh to version 9.1_p1-r16.
- Update openssh to version 10.6_p1-r0.
- Update debian openssh to version 1:10.6p1-1.
- Update debian openssh-gssapi to version 1:10.6p1-1.
- Update canonical openssh to version 1:8.9p1-3ubuntu0.18.
- Update canonical openssh to version 1:9.6p1-3ubuntu13.20.
- Update canonical openssh to version 1:10.2p1-2ubuntu3.8.
- Update openbsd openssh to version 10.6 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | openbsd | openssh | < 10.6 |
| Ubuntu:Pro:14.04:LTS | canonical | openssh | All versions |
| Ubuntu:18.04:LTS | canonical | openssh-ssh1 | All versions |
| Debian:12 | debian | openssh | All versions |
| Debian:14 | debian | openssh-gssapi |
< 1:10.6p1-1 Fix: upgrade to 1:10.6p1-1
|
| Alpaquita:23 | bellsoft | openssh |
>= 9.1_p1-r3, < 9.1_p1-r16 Fix: upgrade to 9.1_p1-r16
|
| Alpaquita:25 | bellsoft | openssh |
>= 10.0_p1-r7, < 10.6_p1-r0 Fix: upgrade to 10.6_p1-r0
|
| Alpaquita:stream | bellsoft | openssh |
>= 9.3_p1-r7, < 10.6_p1-r0 Fix: upgrade to 10.6_p1-r0
|
| BellSoft Hardened Containers:23 | – | openssh |
>= 9.1_p1-r3, < 9.1_p1-r16 Fix: upgrade to 9.1_p1-r16
|
| BellSoft Hardened Containers:25 | – | openssh |
>= 10.0_p1-r7, < 10.6_p1-r0 Fix: upgrade to 10.6_p1-r0
|
| BellSoft Hardened Containers:stream | – | openssh |
>= 9.3_p1-r7, < 10.6_p1-r0 Fix: upgrade to 10.6_p1-r0
|
| Debian:14 | debian | openssh |
< 1:10.6p1-1 Fix: upgrade to 1:10.6p1-1
|
| Ubuntu:22.04:LTS | canonical | openssh |
< 1:8.9p1-3ubuntu0.18 Fix: upgrade to 1:8.9p1-3ubuntu0.18
|
| Ubuntu:24.04:LTS | canonical | openssh |
< 1:9.6p1-3ubuntu13.20 Fix: upgrade to 1:9.6p1-3ubuntu13.20
|
| Ubuntu:26.10 | canonical | openssh-gssapi | All versions |
| Ubuntu:26.04:LTS | canonical | openssh |
< 1:10.2p1-2ubuntu3.8 Fix: upgrade to 1:10.2p1-2ubuntu3.8
|
Original advisory text
BELL-CVE-2026-106584
In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.
References
- https://ubuntu.com/security/CVE-2026-106584 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-106584 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-106584 Vendor Advisory
- https://docs.bell-sw.com/security/cves/CVE-2026-106584 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-1065... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-106584 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8928-1 Vendor Advisory
- https://www.openssh.org/releasenotes.html#10.6 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
3.3
Low
Type
CWE-193Off-by-one Error
Timeline
Published7 Oct 2026
Updated17 Oct 2026
First seen6 Oct 2026
Sources
CVE-2026-106584 · NVD
CVE-2026-106584 · MITRE
UBUNTU-CVE-2026-106584 · OSV
DEBIAN-CVE-2026-106584 · OSV
BELL-CVE-2026-106584 · OSV
CVE-2026-106584 · OSV
Track software like this
Free during beta