ELSA-2026-69130

ELSA-2026-69130 - openssh security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-09-22

Description

[9.9p1-11.0.1]
- Restore pam_ssh_agent_rel values that were used for initial release
- Fix PerSourcePenalties grace-exceeded using the crash penalty value [Orabug: 39825354]
- Replace unsupported ML-KEM hybrid algorithm skip logic with v9.9p1-23.el10_2 ML-KEM/NIST backport [Orabug: 39423076]
- Upstream references found with /usr/bin/ssh [Orabug: 37814929]

[9.9p1-11]
- CVE-2026-73283: Complete the fix of security bypass due to incorrect
handling of forwarding and tunneling options
Resolves: RHEL-245416
- CVE-2026-73281: Fix misinteraction between agent locking and
the session-bind@openssh.com extension
Resolves: RHEL-245424
- CVE-2026-73282: Fix information disclosure and data corruption
via use-after-free in ssh client
Resolves: RHEL-245419

[9.9p1-10]
- Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded
file location
Resolves: RHEL-236320
- Fix CVE-2026-59999 and CVE-2026-73283: Security bypass due to incorrect
handling of forwarding and tunneling options
Resolves: RHEL-236286

Related CVEs

CVE-2026-59995

CVE-2026-59999

CVE-2026-73281

CVE-2026-73282

CVE-2026-73283

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 9 (aarch64)	openssh-9.9p1-11.0.1.el9_8.src.rpm	ab3547de575e3bdbb455985d258778c1b75f6d18a483cfe243a62f44a7da961f	-	ol9_aarch64_appstream
	openssh-9.9p1-11.0.1.el9_8.src.rpm	ab3547de575e3bdbb455985d258778c1b75f6d18a483cfe243a62f44a7da961f	-	ol9_aarch64_baseos_latest
	openssh-9.9p1-11.0.1.el9_8.src.rpm	ab3547de575e3bdbb455985d258778c1b75f6d18a483cfe243a62f44a7da961f	-	ol9_aarch64_u8_baseos_patch
	openssh-9.9p1-11.0.1.el9_8.aarch64.rpm	70625e151da2697ce4f422a5e0cd48a0ad7d5c18e617503352a4af3905a70548	-	ol9_aarch64_baseos_latest
	openssh-9.9p1-11.0.1.el9_8.aarch64.rpm	70625e151da2697ce4f422a5e0cd48a0ad7d5c18e617503352a4af3905a70548	-	ol9_aarch64_u8_baseos_patch
	openssh-askpass-9.9p1-11.0.1.el9_8.aarch64.rpm	ef1f8f3f47926384181c8162363e6bf8583e24aeac208d38881b4cf42b64cf49	-	ol9_aarch64_appstream
	openssh-clients-9.9p1-11.0.1.el9_8.aarch64.rpm	524142f1f42ec174c4d368d942abf7c60f13e8fccfeff8f716b6a3ff0363c074	-	ol9_aarch64_baseos_latest
	openssh-clients-9.9p1-11.0.1.el9_8.aarch64.rpm	524142f1f42ec174c4d368d942abf7c60f13e8fccfeff8f716b6a3ff0363c074	-	ol9_aarch64_u8_baseos_patch
	openssh-keycat-9.9p1-11.0.1.el9_8.aarch64.rpm	6c33fa1c42623598940aa28e4c095633b0f1e57c234b1a43dd3afd35f077d6a8	-	ol9_aarch64_baseos_latest
	openssh-keycat-9.9p1-11.0.1.el9_8.aarch64.rpm	6c33fa1c42623598940aa28e4c095633b0f1e57c234b1a43dd3afd35f077d6a8	-	ol9_aarch64_u8_baseos_patch
	openssh-server-9.9p1-11.0.1.el9_8.aarch64.rpm	7a5f47c454df4c5f2d2a28541a6be8a6f90849f403955a6bae48dfb8a7c39f0e	-	ol9_aarch64_baseos_latest
	openssh-server-9.9p1-11.0.1.el9_8.aarch64.rpm	7a5f47c454df4c5f2d2a28541a6be8a6f90849f403955a6bae48dfb8a7c39f0e	-	ol9_aarch64_u8_baseos_patch
	pam_ssh_agent_auth-0.10.4-9.11.0.1.el9_8.aarch64.rpm	7fbf2b910140944cb8bd0a9c705d6e3bbc63d0354e744435357f72bc8205a8f8	-	ol9_aarch64_appstream
Oracle Linux 9 (x86_64)	openssh-9.9p1-11.0.1.el9_8.src.rpm	ab3547de575e3bdbb455985d258778c1b75f6d18a483cfe243a62f44a7da961f	-	ol9_x86_64_appstream
	openssh-9.9p1-11.0.1.el9_8.src.rpm	ab3547de575e3bdbb455985d258778c1b75f6d18a483cfe243a62f44a7da961f	-	ol9_x86_64_baseos_latest
	openssh-9.9p1-11.0.1.el9_8.src.rpm	ab3547de575e3bdbb455985d258778c1b75f6d18a483cfe243a62f44a7da961f	-	ol9_x86_64_u8_baseos_patch
	openssh-9.9p1-11.0.1.el9_8.x86_64.rpm	52ec47339a858581d463b242c768f2d682e02415103276d90740cafe8229bcd4	-	ol9_x86_64_baseos_latest
	openssh-9.9p1-11.0.1.el9_8.x86_64.rpm	52ec47339a858581d463b242c768f2d682e02415103276d90740cafe8229bcd4	-	ol9_x86_64_u8_baseos_patch
	openssh-askpass-9.9p1-11.0.1.el9_8.x86_64.rpm	43fdc4fb8baa349fc96829c57512ca1132d07d316f058fa136d308f4b4f6e4d2	-	ol9_x86_64_appstream
	openssh-clients-9.9p1-11.0.1.el9_8.x86_64.rpm	c7e338beeb4e032fa049e9bd58136c1846c6b9b00e3e8ffbede871afa3801789	-	ol9_x86_64_baseos_latest
	openssh-clients-9.9p1-11.0.1.el9_8.x86_64.rpm	c7e338beeb4e032fa049e9bd58136c1846c6b9b00e3e8ffbede871afa3801789	-	ol9_x86_64_u8_baseos_patch
	openssh-keycat-9.9p1-11.0.1.el9_8.x86_64.rpm	47360e1e6b4c857e5fc92b9be8943fdfd99727581ab2a458f54fd5f549874a8f	-	ol9_x86_64_baseos_latest
	openssh-keycat-9.9p1-11.0.1.el9_8.x86_64.rpm	47360e1e6b4c857e5fc92b9be8943fdfd99727581ab2a458f54fd5f549874a8f	-	ol9_x86_64_u8_baseos_patch
	openssh-server-9.9p1-11.0.1.el9_8.x86_64.rpm	0bae88247ec11ee25be60f4cd9090fc9b648617e461a07626860d2dd4c9d1993	-	ol9_x86_64_baseos_latest
	openssh-server-9.9p1-11.0.1.el9_8.x86_64.rpm	0bae88247ec11ee25be60f4cd9090fc9b648617e461a07626860d2dd4c9d1993	-	ol9_x86_64_u8_baseos_patch
	pam_ssh_agent_auth-0.10.4-9.11.0.1.el9_8.x86_64.rpm	828b8428db73d9413be5e18a639b185160f646685c7379c329de5dc8f91873bd	-	ol9_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team