CVE-2026-60000
Received Received - Intake

OpenSSH sshd Denial of Service via GSSAPI Authentication

Publication date: 2026-07-08

Last updated on: 2026-07-08

Assigner: MITRE

Description
sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled for GSSAPIAuthentication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-08
Last Modified
2026-07-08
Generated
2026-07-08
AI Q&A
2026-07-08
EPSS Evaluated
N/A
NVD
CVE-2026-60000
EUVD
EUVD-2026-42143

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openssh openssh *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability exists in sshd of OpenSSH versions before 10.4. It allows remote attackers to cause a denial of service by consuming resources through excessive authentication attempts. This happens because the MaxAuthTries setting is mishandled when GSSAPIAuthentication is enabled.

Impact Analysis

This vulnerability can impact you by causing a denial of service condition on the affected system. Remote attackers can exploit it to consume system resources through repeated authentication attempts, potentially making the sshd service unavailable or degraded.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-60000. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart