{
  "threat_severity" : "Important",
  "public_date" : "2026-07-08T00:17:33Z",
  "bugzilla" : {
    "description" : "openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side",
    "id" : "2497936",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2497936"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.7",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
    "status" : "verified"
  },
  "cwe" : "CWE-825",
  "details" : [ "ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)", "A flaw was found in OpenSSH. A remote attacker could exploit a use-after-free vulnerability on the client side when a server changes its host key during a key re-exchange. This could lead to high impact on confidentiality and integrity, and low impact on availability." ],
  "statement" : "This Important flaw in OpenSSH client could allow a malicious SSH server to execute arbitrary code on the connecting client due to a use-after-free vulnerability during host key re-exchange. While requiring a connection to a specially crafted server, the potential for high impact on client confidentiality and integrity elevates the severity beyond Moderate.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-07-30T00:00:00Z",
    "advisory" : "RHSA-2026:47757",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "openssh-0:9.9p1-25.el10_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-07-29T00:00:00Z",
    "advisory" : "RHSA-2026:47756",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "openssh-0:9.9p1-9.el9_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-07-29T00:00:00Z",
    "advisory" : "RHSA-2026:47756",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "openssh-0:9.9p1-9.el9_8"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.22",
    "release_date" : "2026-08-18T00:00:00Z",
    "advisory" : "RHSA-2026:54769",
    "cpe" : "cpe:/a:redhat:openshift:4.22::el9",
    "package" : "rhcos-4.22.9.8.202608130832-0"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37382",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "openssh-main-10.4p1-1.hum1",
    "impact" : "important"
  }, {
    "product_name" : "Red Hat Update Infrastructure 5",
    "release_date" : "2026-08-12T00:00:00Z",
    "advisory" : "RHSA-2026:54387",
    "cpe" : "cpe:/a:redhat:rhui:5::el9",
    "package" : "rhui5/installer-rhel9:1786435483"
  }, {
    "product_name" : "Red Hat Update Infrastructure 5",
    "release_date" : "2026-08-12T00:00:00Z",
    "advisory" : "RHSA-2026:54387",
    "cpe" : "cpe:/a:redhat:rhui:5::el9",
    "package" : "rhui5/rhua-rhel9:1786533529"
  }, {
    "product_name" : "Red Hat Update Infrastructure 5",
    "release_date" : "2026-08-24T00:00:00Z",
    "advisory" : "RHSA-2026:58981",
    "cpe" : "cpe:/a:redhat:rhui:5::el9",
    "package" : "rhui5/installer-tp-rhel9:1787135742"
  }, {
    "product_name" : "Red Hat Update Infrastructure 5",
    "release_date" : "2026-08-24T00:00:00Z",
    "advisory" : "RHSA-2026:58981",
    "cpe" : "cpe:/a:redhat:rhui:5::el9",
    "package" : "rhui5/rhua-tp-rhel9:1787241260"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "openssh",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "openssh",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "openssh",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Not affected",
    "package_name" : "openshift/ose-rhel-coreos-8",
    "cpe" : "cpe:/a:redhat:openshift:4"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-60002\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-60002\nhttps://marc.info/?l=openssh-unix-dev&m=178333966933090&w=2\nhttps://www.openssh.org/releasenotes.html#10.4p1\nhttps://www.openwall.com/lists/oss-security/2026/07/06/5" ],
  "name" : "CVE-2026-60002",
  "mitigation" : {
    "value" : "To mitigate this issue, OpenSSH clients should only connect to trusted SSH servers. Enforcing strict host key checking and carefully managing `known_hosts` files can help prevent connections to servers with unexpected or altered host keys, thereby reducing exposure to this client-side vulnerability.",
    "lang" : "en:us"
  },
  "csaw" : false
}