CVE-2026-35387

6.5 mediumEPSS 0.2%

Medium (6.5) in openbsd openssh. EPSS 0.2% chance of exploitation in the next 30 days.

OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA algorithms.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 15% of CVEs (scores of 2026-10-31)
CWE: CWE-670
Published: 2026-04-02
Modified: 2026-07-24
Record from: the NVD, synced 2026-10-19

Affected

openbsd:openssh

References

https://marc.info/?l=openssh-unix-dev&m=177513443901484&w=2
https://www.openssh.org/releasenotes.html#10.3p1
https://www.openwall.com/lists/oss-security/2026/04/02/3

Check your stack JSON