This page tracks the Alpine Linux fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-60002 →

ALPINE-CVE-2026-60002

ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the cli...

Original description

The description as published by the source.

ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Alpine:v3.24 openssh

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.3_p1-r1"}]}]

References

advisory security.alpinelinux.org