CVE-2026-73282 Use after free in OpenSSH
A use-after-free in OpenSSH allows attackers to potentially execute code or cause denial of service via concurrent remote-forwarding operations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-73282?
CVE-2026-73282 is a medium-severity use after free vulnerability in OpenSSH, published on 11 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.
Weakness: CWE-416
Which versions are affected by CVE-2026-73282?
It affects 1 product.
Products include OpenSSH.
How do I fix CVE-2026-73282?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-73282 being exploited?
There is no known exploitation of CVE-2026-73282 in the wild and no public exploit code.
Other vulnerabilities in OpenSSH
Sources
Also known as ALPINE-CVE-2026-73282, AZL-95538, BELL-CVE-2026-73282, CLSA-2026-1788885099, CLSA-2026-1788942428, CLSA-2026-1788942887 and 12 more.