Bug#1132575: openssh: CVE-2026-35388

Salvatore Bonaccorso <[email protected]> Fri, 03 Apr 2026 10:58:07 +0200

Newsgroups	gmane.linux.debian.devel.ssh
Message-ID	<177520668772.222922.17392408152863340384.reportbug__4164.33351799554$1775206770$gmane$org@eldamar.lan>

Source: openssh
Version: 1:10.2p1-6
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>

Hi,

The following vulnerability was published for openssh.

CVE-2026-35388[0]:
| OpenSSH before 10.3 omits connection multiplexing confirmation for
| proxy-mode multiplexing sessions.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-35388
    https://www.cve.org/CVERecord?id=CVE-2026-35388
[1] https://www.openssh.org/releasenotes.html#10.3p1

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore