OpenSSH vor 10.3 lässt die Bestätigung der Verbindungsmultiplexierung für Multiplexing-Sitzungen im Proxy-Modus aus.

The primary impact of CVE-2026-35388 is a potential denial-of-service (DoS). An attacker leveraging this vulnerability could craft malicious requests to overwhelm the OpenSSH server, preventing legitimate users from establishing connections. This could disrupt remote access, SSH tunneling, and other services reliant on OpenSSH. While the CVSS score is low, the impact can be significant in environments where SSH is critical for system administration or secure remote access. The lack of connection multiplexing confirmation allows for easier exploitation and resource exhaustion. The blast radius is limited to the OpenSSH service itself; however, the disruption of SSH access can cascade to dependent systems and applications.

1. Reserviert2026-04-02
2. Veröffentlicht2026-04-02
3. EPSS aktualisiert2026-04-10

The primary mitigation for CVE-2026-35388 is to upgrade OpenSSH to version 10.3 or later. Before upgrading, it's crucial to review the OpenSSH 10.3 release notes for any compatibility issues with existing configurations or applications. If a direct upgrade is not feasible due to compatibility concerns, consider implementing temporary workarounds such as rate limiting SSH connections at the firewall or proxy level to mitigate potential DoS attacks. Monitor OpenSSH logs for unusual connection patterns or errors that might indicate exploitation attempts. After upgrading, confirm the fix by attempting to establish a proxy-mode multiplexing session and verifying that connection confirmation is properly handled.