Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N N N N L L 6.9 .0130 70.0 —
AFFECTED Product Versions Fixed openssh 1:10.0p1-5ubuntu5 – —
TIMELINE Mar 3 Reserved by canonical Mar 12 Published (CNA: canonical) Oct 15 RESCORED — CVE-2026-3497 (Ubuntu openssh). CVSS 2.7 → 6.9 (NVD).
Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux distributions and does not affect the OpenSSH upstream project itself. The usage of sshpkt_disconnect() on an error, which does not terminate the process, allows an attacker to send an unexpected GSSAPI message type during the GSSAPI key exchange to the server, which will call the underlying function and continue the execution of the program without setting the related connection variables. As the variables are not initialized to NULL the code later accesses those uninitialized variables, accessing random memory, which could lead to undefined behavior. The recommended workaround is to use ssh_packet_disconnect() instead, which does terminate the process. The impact of the vulnerability depends heavily on the compiler flag hardening configuration.
| Date | Event | Detail |
|---|---|---|
| March 3, 2026 | Reserved | Reserved by canonical |
| March 12, 2026 | Published | Published (CNA: canonical) |
| October 15, 2026 | RESCORED | RESCORED — CVE-2026-3497 (Ubuntu openssh). CVSS 2.7 → 6.9 (NVD). |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| Ubuntu | openssh | — | 1:10.0p1-5ubuntu5 | — |
Authoritative record: CVE-2026-3497 at cve.org
Vendors: ubuntu
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-3497 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
