In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• openbsd opensshbefore 10.5

Versions reported by the vendor

Affected version ranges reported by the assigning authority (mitre). Independent of NVD's CPE analysis and usually ahead of it.

• OpenBSD OpenSSH

  • before 10.5affected

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2023-38408The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if
  63This week
• CVE-2018-15473OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after
  60This week
• CVE-2016-6210sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the us
  60This week

Published before and after this one in the same product

• ← EarlierCVE-2026-60002Jul 7, 2026 · ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange.
  37Monitor
• ← EarlierCVE-2026-73281Aug 11, 2026 · In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that a
  14Monitor
• Later →CVE-2026-73283Aug 11, 2026 · In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.
  10Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

After a memory region is freed, another reference pointing to it is still used. By then, the same region may have been allocated for different data.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1free(dev->buf);2/* ... another thread is still running ... */3process(dev->buf);

1lock(&dev->lock);2free(dev->buf);3dev->buf = NULL;4unlock(&dev->lock);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.