add warning not to use `Match exec` in /etc/ssh/ssh_config to control
EnableSSHKeysign, as the user effectively controls how `Match exec`
commands are run.
Anthropic ANT-2026-1W8VNWB5
(Anthropic proposed a fix, but IMO this is likely such a rarity that an
admonition is sufficient).
ssh-keysign identifies the name that it will sign a hostbased challenge
for using the connected socket. On some platforms it's possible to
construct that returns an off-host address via getpeername(). In these
cases, ssh-keysign (if enabled) can be tricked into a signing a challenge
for an arbitrary destination if a bunch other default-off dominos fall
just right.
This checks that the peername of the socket is actually an address that
appears on an attached interface.
Anthropic ANT-2026-1BDN8VMO
used cached hostname for `Match host` when UseDNS=yes; avoids multiple
lookups for same host and a different number of lookups when the user
exists vs not.
Anthropic ANT-2026-14BFHJ3R
Add RBTREE index over keyblob for KRL CA sections
This avoid O(N^2) lookups which can grow pretty large when revoking many
separate CA keys.
Anthropic ANT-2026-L7T0QBTG
ok tb@
don't let SSH_MSG_PONG replies pile up if the peer isn't sending ACKs
and there is a significant amount of data in data in out transport obuf.
Avoids an obscure post-auth soft memory DoS
Anthropic ANT-2026-Z4SZFUYY
make StrictModes apply to ~/.k5login and the home directory that
contains it, just like how it applies to other authn-critical files.
Anthropic ANT-2026-W7F2ULDN
avoid fatal() if a PKCS#11 key was added multiple times (e.g. for
multiple certificates) and then subsequently freed. The key-free code
incorrectly assumed that keys were singular.
Anthropic ANT-2026-V7H1QCC4
only replace prior auth_opts if merging later ones succeeds.
Part of fix for server fatal() with inconsistent log message when
`AuthenticationMethods publickey,publickey` fails on the second key because
of inconsistent authentication options.
Anthropic ANT-2026-UES5TKX0
make strict KEX errors return an error rather than fatal()ing the
process. This avoids ssh-keyscan crashing out when one host of many
fails strict KEX.
To avoid the risk of continuing past such a failure in ssh or sshd, make
such failures "poison" the packet code so that future attempts to send
or receive packets always an error.
Anthropic ANT-2026-TU0DN0EM (poisoning bit by me)
fix ChannelTimeout for PermitTunnel forwardings. These were not being
applied because 1) the server used an unexpected name to label the
channel and 2) the "last used" time was never set for these channels and
this would cause the timeout never to fire.
Anthropic ANT-2026-SF9IN6I4
apply the existing limit for destination constraint usernames to the
usernames parsed from hostbound signature requests, as these are a
potential DoS channel against a destination-constrained agent
Anthropic ANT-2026-SE08NY49
include the entire ProxyJump specification in the %j and %C TOKENS
previously this just included the jump _host_ alone and dropped the
port, username and extra jump hops.
Anthropic ANT-2026-S9DT2E2E
enforce a global limit on the number of keys ssh-agent will store
in destination constraints, also avoid calculating fingerprints for
keys for use in debugging messages if debugging isn't enabled
avoids more worst-case behaviour in ssh-agent.
Anthropic ANT-2026-S1SM8TCF
harden privsep monitor: enforce CASignatureAlgorithms and RequiredRSASize
checks for keys received from the unpriv process during publickey and
hostbased authentication
Anthropic ANT-2026-RBFG1KXP
grow destination buffer more aggressively to avoid bad worst-case
behaviour when lots of characters that need escaping are processed
Anthropic ANT-2026-P8BKU1E3
make `RevokedKeys none` inside a `Match` block do what it is supposed
to do, rather than try to load a file called `none`, fail and refuse all
connections
Anthropic ANT-2026-NBFF2HDP
make ConnectTimeout apply to the initial KEX as ssh.1 promises.
This isn't perfect: the timeout is applied per-packet read() rather
than as a total time bound, but it at least allows a connection that
stalls post-banner and pre-KEX to be automatically terminated
Anthropic NT-2026-LZZ8V5RF
don't count time spent in getaddrinfo() or obtaining the hostname to scan
from stdin against active ssh-keyscan connections in progress.
Avoids incorrectly timing out good hosts during unrelated stalled
lookups/reads
Anthropic ANT-2026-LU2X6L18
better accounting when the peer exceeds it channel window. We allow a 10%
grace before the connection is terminated but previously would reset the
excess if the peer sent an empty packet after going into excess, allowing
them to buffer more data than intended.
This now requires the peer to fully pay down the excess before giving
them back window.
Anthropic ANT-2026-KM8MV6JI
clean up Kerberos ccache if KerberosAuthentication password authentication
succeeds but the session is subsequently refused.
Anthropic ANT-2026-JGFGOUGS
