ELSA-2026-85958

ELSA-2026-85958 - openssh security update

Type:	SECURITY
Impact:	MODERATE
Release Date:	2026-10-21

Description

[9.9p1-13.0.1]
- Restore pam_ssh_agent_rel values that were used for initial release
- Fix PerSourcePenalties grace-exceeded using the crash penalty value [Orabug: 39825354]
- Replace unsupported ML-KEM hybrid algorithm skip logic with v9.9p1-23.el10_2 ML-KEM/NIST backport [Orabug: 39423076]
- Upstream references found with /usr/bin/ssh [Orabug: 37814929]

[9.9p1-13]
- CVE-2026-59998: Document caveat regarding GSSAPIStrictAcceptorCheck
Resolves: RHEL-276221
- CVE-2026-59997: Fix internal-sftp server argument parsing limit
Resolves: RHEL-276234
- CVE-2026-60000: Fix DoS via excessive GSSAPI authentication attempts
Resolves: RHEL-276230

Related CVEs

CVE-2026-59997

CVE-2026-59998

CVE-2026-60000

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 9 (aarch64)	openssh-9.9p1-13.0.1.el9_8.src.rpm	eb9639579b4fa5c0a54834bed0af585aab6d4c337cd2129954ad9be4715d5ba1	-	ol9_aarch64_appstream
	openssh-9.9p1-13.0.1.el9_8.src.rpm	eb9639579b4fa5c0a54834bed0af585aab6d4c337cd2129954ad9be4715d5ba1	-	ol9_aarch64_baseos_latest
	openssh-9.9p1-13.0.1.el9_8.src.rpm	eb9639579b4fa5c0a54834bed0af585aab6d4c337cd2129954ad9be4715d5ba1	-	ol9_aarch64_u8_baseos_patch
	openssh-9.9p1-13.0.1.el9_8.aarch64.rpm	4ae26c800a2fec42fdc5fc635303779f518949fbea5d5059f22a56f818b9951f	-	ol9_aarch64_baseos_latest
	openssh-9.9p1-13.0.1.el9_8.aarch64.rpm	4ae26c800a2fec42fdc5fc635303779f518949fbea5d5059f22a56f818b9951f	-	ol9_aarch64_u8_baseos_patch
	openssh-askpass-9.9p1-13.0.1.el9_8.aarch64.rpm	334e4ee9b97b83eb053e4a7fb8552c532d8cad887e37b750f9472321e13abc49	-	ol9_aarch64_appstream
	openssh-clients-9.9p1-13.0.1.el9_8.aarch64.rpm	87380eeff3ae2d04723cd4c5aee26b7f239d0cbffa2ae6357ff8281b15a01359	-	ol9_aarch64_baseos_latest
	openssh-clients-9.9p1-13.0.1.el9_8.aarch64.rpm	87380eeff3ae2d04723cd4c5aee26b7f239d0cbffa2ae6357ff8281b15a01359	-	ol9_aarch64_u8_baseos_patch
	openssh-keycat-9.9p1-13.0.1.el9_8.aarch64.rpm	5a8f4ac12fd4e41c6dde5ad34cff5c521052d5442717e18436f7ab6b8adda905	-	ol9_aarch64_baseos_latest
	openssh-keycat-9.9p1-13.0.1.el9_8.aarch64.rpm	5a8f4ac12fd4e41c6dde5ad34cff5c521052d5442717e18436f7ab6b8adda905	-	ol9_aarch64_u8_baseos_patch
	openssh-server-9.9p1-13.0.1.el9_8.aarch64.rpm	390c72631eb48083e413abe4ad18940830e27216502ad764824460004c2601c7	-	ol9_aarch64_baseos_latest
	openssh-server-9.9p1-13.0.1.el9_8.aarch64.rpm	390c72631eb48083e413abe4ad18940830e27216502ad764824460004c2601c7	-	ol9_aarch64_u8_baseos_patch
	pam_ssh_agent_auth-0.10.4-9.13.0.1.el9_8.aarch64.rpm	bdd5beb86dec50efcd9c59db874fc038b2f989757295ede4de900f2e50de1c56	-	ol9_aarch64_appstream
Oracle Linux 9 (x86_64)	openssh-9.9p1-13.0.1.el9_8.src.rpm	eb9639579b4fa5c0a54834bed0af585aab6d4c337cd2129954ad9be4715d5ba1	-	ol9_x86_64_appstream
	openssh-9.9p1-13.0.1.el9_8.src.rpm	eb9639579b4fa5c0a54834bed0af585aab6d4c337cd2129954ad9be4715d5ba1	-	ol9_x86_64_baseos_latest
	openssh-9.9p1-13.0.1.el9_8.src.rpm	eb9639579b4fa5c0a54834bed0af585aab6d4c337cd2129954ad9be4715d5ba1	-	ol9_x86_64_u8_baseos_patch
	openssh-9.9p1-13.0.1.el9_8.x86_64.rpm	d436d20dba176136a38f2ee50990cacaf76d35cfbb781374252f21ec8d713a73	-	ol9_x86_64_baseos_latest
	openssh-9.9p1-13.0.1.el9_8.x86_64.rpm	d436d20dba176136a38f2ee50990cacaf76d35cfbb781374252f21ec8d713a73	-	ol9_x86_64_u8_baseos_patch
	openssh-askpass-9.9p1-13.0.1.el9_8.x86_64.rpm	78c03cc8639a86c8f9f5415ca0db497632d4207afa28875df1eb408eff3d14c0	-	ol9_x86_64_appstream
	openssh-clients-9.9p1-13.0.1.el9_8.x86_64.rpm	07bbcefb8283a1f4c043fbf71367d966156c217ee24a67bc3cd31581fd395284	-	ol9_x86_64_baseos_latest
	openssh-clients-9.9p1-13.0.1.el9_8.x86_64.rpm	07bbcefb8283a1f4c043fbf71367d966156c217ee24a67bc3cd31581fd395284	-	ol9_x86_64_u8_baseos_patch
	openssh-keycat-9.9p1-13.0.1.el9_8.x86_64.rpm	13182edb8a80ef890f86c2c03cde6cb1fb65427b6620c1877ae602b91945fb8a	-	ol9_x86_64_baseos_latest
	openssh-keycat-9.9p1-13.0.1.el9_8.x86_64.rpm	13182edb8a80ef890f86c2c03cde6cb1fb65427b6620c1877ae602b91945fb8a	-	ol9_x86_64_u8_baseos_patch
	openssh-server-9.9p1-13.0.1.el9_8.x86_64.rpm	985675edee69dae17b967323b513069c400d51b326102e1aba33c59785378cd7	-	ol9_x86_64_baseos_latest
	openssh-server-9.9p1-13.0.1.el9_8.x86_64.rpm	985675edee69dae17b967323b513069c400d51b326102e1aba33c59785378cd7	-	ol9_x86_64_u8_baseos_patch
	pam_ssh_agent_auth-0.10.4-9.13.0.1.el9_8.x86_64.rpm	d1956842d423264f98b7db8ea9a958b5f098d46637fac48c0712c008f6012caf	-	ol9_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team