Tech

Critical security vulnerability affects OpenSSH on Alpine Linux systems

Read full article at source ↗

Based on a feed excerpt; full article content has not been acquired. Source evidence retrieved 05/11/2026, 11:50:24 UTC.

Briefings

A critical OpenSSH vulnerability affecting Alpine Linux systems using musl libc without PAM has been patched in version 10.6p2. The vulnerability does not exist on non-Linux systems or those using glibc with PAM enabled. Alpine Linux will backport the fix to Alpine 3.16, released in May 2022.

Key points

• OpenSSH version 10.6p2 includes a workaround for a critical vulnerability affecting Alpine Linux systems using musl libc with PAM disabled.
• The vulnerability does not exist on non-Linux systems or Linux systems using glibc with PAM enabled.

Context

OpenSSH developer Damien Miller stated that systems using musl libc without PAM, such as Alpine Linux, must immediately disable SSH or set PasswordAuthentication=no. The Alpine Linux project announced backporting the fix to Alpine 3.16, released in May 2022.

Limitations

Evidence covers only Alpine Linux systems using musl libc without PAM. No data on affected non-Linux systems, glibc systems, or PAM-enabled systems is provided. No specific impact metrics, user statistics, or security incident reports are included.

Generated by Bittrees-hosted qwen35-2b sha256:aaf42c8b7c3c on 05/11/2026, 12:49:18 UTC. Based on publisher-provided feed evidence; may not cover the full original article. Check the source for details.

View archived briefing on IPFS
bafybeie26kq6knhlltexe3z6famq4tx5473fkaphzq2sgo7733vjdt7yzq