Bug#1132574: openssh: CVE-2026-35387

Salvatore Bonaccorso <[email protected]> Fri, 03 Apr 2026 10:56:42 +0200

Newsgroups	gmane.linux.debian.devel.ssh
Message-ID	<177520660254.222306.12282670218429009070.reportbug__41317.645278626$1775206770$gmane$org@eldamar.lan>

Source: openssh
Version: 1:10.2p1-6
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>

Hi,

The following vulnerability was published for openssh.

CVE-2026-35387[0]:
| OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of
| any ECDSA algorithm in PubkeyAcceptedAlgorithms or
| HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA
| algorithms.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-35387
    https://www.cve.org/CVERecord?id=CVE-2026-35387
[1] https://www.openssh.org/releasenotes.html#10.3p1

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore