Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
OpenSSH certificates may show wrong expiration dates
published 29 days ago
Summary
The OpenSSH tool used to create SSH keys can calculate certificate expiration times incorrectly, especially when daylight‑saving changes are involved. This could cause keys to appear expired too early or remain valid longer than intended, which may affect access control. Upgrade OpenSSH to version 10.6 or later, or apply the vendor's recommended update to fix the date calculation.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | openssh | <= 9.8p1-10 |
Original advisory text
CVE-2026-106584 affecting package openssh 9.8p1-10
In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.
References
Timeline
Published6 Oct 2026
Updated7 Oct 2026
First seen7 Oct 2026
Sources
AZL-106703 · OSV
Track software like this
Free during beta