Affected: OpenBSD OpenSSH

In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.

Affected: Ubuntu:22.04:LTS: openssh, Ubuntu:24.04:LTS: openssh, Ubuntu:26.04:LTS: openssh

It was discovered that OpenSSH's sftp client incorrectly handled paths returned by the server during a recursive copy operation. A remote attacker controlling the server could possibly use this issue to write files to unintended locations. (CVE-2026-106552)

It was discovered that OpenSSH's sshd server incorrectly handled GSSAPIAuthentication state across authentication attempts. An attacker could possibly use this issue to obtain credentials from a previous failed authentication attempt. (CVE-2026-106553, CVE-2026-106555)

It was discovered that OpenSSH incorrectly used an LZ77 dictionary coder during compression. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-106582)

It was discovered that OpenSSH's ssh client incorrectly allowed special characters in command-line usernames. An attacker could possibly use this issue to inject arbitrary commands via specially crafted usernames. (CVE-2026-106583)

It was discovered that OpenSSH's ssh-keygen incorrectly handled Daylight Saving Time when converting dates. An attacker could possibly use this issue to cause certificates to have incorrect expiration times. (CVE-2026-106584)

It was discovered that OpenSSH did not check whether the maximum packet length was exceeded during decompression. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-106585)

It was discovered that OpenSSH's sshd server incorrectly applied the restrict keyword from authorized_keys to t…