Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
OpenSSH on CentOS Stream can crash during remote forwarding
published 1 month ago
Summary
The OpenSSH packages for CentOS Stream may stop working when a remote connection request is confirmed, potentially disrupting SSH tunnels. This happens because the program can free memory incorrectly while handling the request. Apply the latest package updates for OpenSSH, OpenSSH‑askpass, OpenSSH‑cavs, OpenSSH‑clients, and OpenSSH‑keycat to fix the issue.
What to do
- Update centos-stream openssh to version 8.0p1-24.el8.tuxcare.els10.
- Update centos-stream openssh-askpass to version 8.0p1-24.el8.tuxcare.els10.
- Update centos-stream openssh-cavs to version 8.0p1-24.el8.tuxcare.els10.
- Update centos-stream openssh-clients to version 8.0p1-24.el8.tuxcare.els10.
- Update centos-stream openssh-keycat to version 8.0p1-24.el8.tuxcare.els10.
- Update centos-stream openssh-ldap to version 8.0p1-24.el8.tuxcare.els10.
- Update centos-stream openssh-server to version 8.0p1-24.el8.tuxcare.els10.
- Update centos-stream pam_ssh_agent_auth to version 0.10.3-7.24.el8.tuxcare.els10.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:CentOS-Stream:8 | centos-stream | openssh |
< 8.0p1-24.el8.tuxcare.els10 Fix: upgrade to 8.0p1-24.el8.tuxcare.els10
|
| TuxCare:CentOS-Stream:8 | centos-stream | openssh-askpass |
< 8.0p1-24.el8.tuxcare.els10 Fix: upgrade to 8.0p1-24.el8.tuxcare.els10
|
| TuxCare:CentOS-Stream:8 | centos-stream | openssh-cavs |
< 8.0p1-24.el8.tuxcare.els10 Fix: upgrade to 8.0p1-24.el8.tuxcare.els10
|
| TuxCare:CentOS-Stream:8 | centos-stream | openssh-clients |
< 8.0p1-24.el8.tuxcare.els10 Fix: upgrade to 8.0p1-24.el8.tuxcare.els10
|
| TuxCare:CentOS-Stream:8 | centos-stream | openssh-keycat |
< 8.0p1-24.el8.tuxcare.els10 Fix: upgrade to 8.0p1-24.el8.tuxcare.els10
|
| TuxCare:CentOS-Stream:8 | centos-stream | openssh-ldap |
< 8.0p1-24.el8.tuxcare.els10 Fix: upgrade to 8.0p1-24.el8.tuxcare.els10
|
| TuxCare:CentOS-Stream:8 | centos-stream | openssh-server |
< 8.0p1-24.el8.tuxcare.els10 Fix: upgrade to 8.0p1-24.el8.tuxcare.els10
|
| TuxCare:CentOS-Stream:8 | centos-stream | pam_ssh_agent_auth |
< 0.10.3-7.24.el8.tuxcare.els10 Fix: upgrade to 0.10.3-7.24.el8.tuxcare.els10
|
Original advisory text
openssh: Fix of CVE-2026-73282
- CVE-2026-73282: fix potential realloc use-after-free in ssh remote
forwarding confirmation
forwarding confirmation
References
- https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1788942428.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-73282 Vendor Advisory
Timeline
Published9 Sep 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1788942428 · OSV
Track software like this
Free during beta