CVE-2026-60002
ADVISORY - debianSummary
ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)
- openssh 1:10.4p1-1 [trixie] - openssh (Minor issue) [bookworm] - openssh (Minor issue) [bullseye] - openssh (Minor issue) https://www.openssh.org/releasenotes.html#10.4p1
EPSS Score: 0.003 (0.226)
Common Weakness Enumeration (CWE)
ADVISORY - redhat
Expired Pointer Dereference
Alpine
CREATED
UPDATED
ADVISORY IDCVE-2026-60002
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
| Package | Type | OS Name | OS Version | Affected Ranges | Fix Versions |
|---|---|---|---|---|---|
| alpine/openssh | apk | alpine | 3.23 | <=10.2_p1-r0 | Not yet available |
| alpine/openssh | apk | alpine | 3.20 | <=7.4_p1-r0 | Not yet available |
| alpine/openssh | apk | alpine | 3.20 | <=7.5_p1-r8 | Not yet available |
| alpine/openssh | apk | alpine | 3.20 | <=7.7_p1-r4 | Not yet available |
| alpine/openssh | apk | alpine | 3.20 | <=7.9_p1-r3 | Not yet available |
| alpine/openssh | apk | alpine | 3.20 | <=8.4_p1-r0 | Not yet available |
| alpine/openssh | apk | alpine | 3.20 | <=8.5_p1-r0 | Not yet available |
| alpine/openssh | apk | alpine | 3.20 | <=8.8_p1-r0 | Not yet available |
| alpine/openssh | apk | alpine | 3.20 | <=9.6_p1-r0 | Not yet available |
| alpine/openssh | apk | alpine | 3.20 | <=9.7_p1-r4 | Not yet available |
| alpine/openssh | apk | alpine | 3.20 | <=9.7_p1-r5 | Not yet available |
| alpine/openssh | apk | alpine | 3.19 | <=7.4_p1-r0 | Not yet available |
| alpine/openssh | apk | alpine | 3.19 | <=7.5_p1-r8 | Not yet available |
| alpine/openssh | apk | alpine | 3.19 | <=7.7_p1-r4 | Not yet available |
| alpine/openssh | apk | alpine | 3.19 | <=7.9_p1-r3 | Not yet available |
| alpine/openssh | apk | alpine | 3.19 | <=8.4_p1-r0 | Not yet available |
| alpine/openssh | apk | alpine | 3.19 | <=8.5_p1-r0 | Not yet available |
| alpine/openssh | apk | alpine | 3.19 | <=8.8_p1-r0 | Not yet available |
| alpine/openssh | apk | alpine | 3.19 | <=9.6_p1-r0 | Not yet available |
| alpine/openssh | apk | alpine | 3.19 | <=9.6_p1-r1 | Not yet available |
| alpine/openssh | apk | alpine | 3.19 | <=9.6_p1-r2 | Not yet available |
| alpine/openssh | apk | alpine | 3.19 | <=9.7_p2-r5 | Not yet available |
| alpine/openssh | apk | alpine | 3.21 | <=7.4_p1-r0 | Not yet available |
| alpine/openssh | apk | alpine | 3.21 | <=7.5_p1-r8 | Not yet available |
| alpine/openssh | apk | alpine | 3.21 | <=7.7_p1-r4 | Not yet available |
| alpine/openssh | apk | alpine | 3.21 | <=7.9_p1-r3 | Not yet available |
| alpine/openssh | apk | alpine | 3.21 | <=8.4_p1-r0 | Not yet available |
| alpine/openssh | apk | alpine | 3.21 | <=8.5_p1-r0 | Not yet available |
| alpine/openssh | apk | alpine | 3.21 | <=8.8_p1-r0 | Not yet available |
| alpine/openssh | apk | alpine | 3.21 | <=9.6_p1-r0 | Not yet available |
| alpine/openssh | apk | alpine | 3.21 | <=9.8_p1-r0 | Not yet available |
| alpine/openssh | apk | alpine | 3.21 | <=9.9_p1-r2 | Not yet available |
| alpine/openssh | apk | alpine | 3.21 | <=9.9_p2-r0 | Not yet available |
| alpine/openssh | apk | alpine | 3.22 | <=10.0_p1-r10 | Not yet available |
| alpine/openssh | apk | alpine | 3.22 | <=10.0_p1-r7 | Not yet available |
| alpine/openssh | apk | alpine | 3.22 | <=10.0_p1-r8 | Not yet available |
| alpine/openssh | apk | alpine | 3.22 | <=10.0_p1-r9 | Not yet available |
| alpine/openssh | apk | alpine | 3.22 | <=7.4_p1-r0 | Not yet available |
| alpine/openssh | apk | alpine | 3.22 | <=7.5_p1-r8 | Not yet available |
| alpine/openssh | apk | alpine | 3.22 | <=7.7_p1-r4 | Not yet available |
| alpine/openssh | apk | alpine | 3.22 | <=7.9_p1-r3 | Not yet available |
| alpine/openssh | apk | alpine | 3.22 | <=8.4_p1-r0 | Not yet available |
| alpine/openssh | apk | alpine | 3.22 | <=8.5_p1-r0 | Not yet available |
| alpine/openssh | apk | alpine | 3.22 | <=8.8_p1-r0 | Not yet available |
| alpine/openssh | apk | alpine | 3.22 | <=9.6_p1-r0 | Not yet available |
| alpine/openssh | apk | alpine | 3.22 | <=9.8_p1-r0 | Not yet available |
| alpine/openssh | apk | alpine | 3.22 | <=9.9_p2-r0 | Not yet available |
Severity and metrics
No CVSS data available from this advisory.
Debian
CREATED
UPDATED
ADVISORY IDCVE-2026-60002
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
Ubuntu
CREATED
UPDATED
ADVISORY IDCVE-2026-60002
EXPLOITABILITY SCORE
3.9
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
CVSS SCORE
9.4mediumAlma
CREATED
UPDATED
ADVISORY IDALSA-2026:47756
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
CVSS SCORE
N/AhighAmazon
CREATED
UPDATED
ADVISORY IDALAS2023-2026-2031
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
CVSS SCORE
N/AmediumRed Hat
CREATED
UPDATED
ADVISORY IDCVE-2026-60002
EXPLOITABILITY SCORE
2.2
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)
CVSS SCORE
7.7highRocky
CREATED
UPDATED
ADVISORY IDRLSA-2026:47756
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
CVSS SCORE
N/AhighRocky
CREATED
UPDATED
ADVISORY IDRLSA-2026:47757
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
CVSS SCORE
N/AhighOracle
CREATED
UPDATED
ADVISORY IDELSA-2026-47756
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
CVSS SCORE
N/AhighOracle
CREATED
UPDATED
ADVISORY IDELSA-2026-47757
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
CVSS SCORE
N/AhighPhoton
CREATED
UPDATED
ADVISORY ID
CVE-2026-60002
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-