CVE-2026-35387: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-35387 is an algorithm misinterpretation vulnerability in OpenSSH before version 10.3 where listing any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is incorrectly interpreted as permitting all ECDSA algorithms, rather than only the explicitly specified one. The vulnerability was disclosed on April 2, 2026, alongside the release of OpenSSH 10.3, and was reported by Christos Papakonstantinou of Cantina and Spearbit. It affects all OpenSSH versions prior to 10.3, including IBM AIX deployments using OpenSSH. The CVSS v3.1 base score is 3.1 (Low) per the GitHub Advisory Database, though Feedly's estimate places it at 6.5 (Medium) under a different scoring interpretation (Github Advisory, oss-security).

The root cause is classified as CWE-670 (Always-Incorrect Control Flow Implementation): the sshd code path that evaluates PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms contains a logic flaw where the presence of any ECDSA algorithm name (e.g., ecdsa-sha2-nistp384) in the directive causes the server to accept any ECDSA algorithm variant, bypassing the intended restriction. This is a server-side misconfiguration enforcement failure — the configuration is parsed correctly but not applied correctly during algorithm negotiation. Exploitation requires network access and an authenticated user (low privileges), with high attack complexity, as the attacker must possess valid credentials and leverage an ECDSA key type not explicitly permitted by the administrator's policy (oss-security, Github Advisory).

An authenticated attacker can authenticate using an ECDSA algorithm variant that the system administrator did not intend to permit, undermining the integrity of SSH access controls. There is no confidentiality or availability impact — the primary concern is integrity, as unauthorized algorithm usage could allow a user to bypass algorithm-based access restrictions. The impact is limited in scope (no privilege escalation or data exfiltration is directly enabled), but it could undermine compliance requirements or security policies that rely on restricting specific cryptographic algorithms (Github Advisory, oss-security).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Github Advisory). The EPSS score is approximately 0.027% (0.000270), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The high attack complexity (requiring valid credentials and specific ECDSA key material) significantly limits practical exploitability.

1. Reconnaissance: Identify SSH servers running OpenSSH versions prior to 10.3 that have PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms configured with at least one ECDSA algorithm (e.g., ecdsa-sha2-nistp384) but not all ECDSA variants.
2. Obtain valid credentials: The attacker must already possess a valid user account and an ECDSA key pair (e.g., using a curve not listed in the server's policy, such as ecdsa-sha2-nistp256 when only ecdsa-sha2-nistp521 is listed).
3. Attempt authentication with non-permitted ECDSA algorithm: Connect to the target SSH server using an ECDSA key of a type not explicitly listed in the server's algorithm policy (e.g., ssh -i ~/.ssh/id_ecdsa_p256 user@target).
4. Bypass algorithm restriction: Due to the control flow flaw, the server accepts the authentication attempt with the non-permitted ECDSA algorithm, granting access in violation of the administrator's intended policy (oss-security, Github Advisory).

• Logs: SSH authentication log entries (/var/log/auth.log or journalctl -u sshd) showing successful logins using an ECDSA algorithm variant (e.g., ecdsa-sha2-nistp256) that is not explicitly listed in the server's PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms directives.
• Network: SSH handshake traffic (port 22) where the negotiated public key algorithm differs from the algorithms explicitly configured in sshd_config; detectable via packet capture and SSH protocol analysis tools.
• Configuration Audit: Presence of any ECDSA algorithm name in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms on OpenSSH versions prior to 10.3, which indicates the system is vulnerable regardless of which specific ECDSA variant is listed.

The primary remediation is to upgrade OpenSSH to version 10.3 or later, which contains the fix for this vulnerability (oss-security). Patches are available for major Linux distributions including Red Hat (RHSA-2026:12389 and subsequent advisories), Ubuntu (USN-8222-1), Debian, AlmaLinux, Rocky Linux, Amazon Linux 2023, and IBM AIX (IBM Advisory). As a temporary workaround for systems that cannot be immediately patched, administrators should remove all ECDSA algorithms from PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms entirely, or restrict authentication to non-ECDSA algorithms (e.g., Ed25519 or RSA), understanding that the current implementation cannot reliably enforce ECDSA algorithm restrictions.

The vulnerability was disclosed as part of the OpenSSH 10.3 release announcement by Damien Miller on the oss-security mailing list, crediting Christos Papakonstantinou of Cantina and Spearbit for the report (oss-security). Security coverage appeared on SecurityOnline.info and Pro-Linux.de shortly after disclosure. Vendor responses were broad, with Red Hat, Ubuntu, Debian, AlmaLinux, Rocky Linux, Amazon Linux, IBM, Juniper Networks, and Palo Alto Networks all issuing advisories or impact assessments. Community reaction was measured given the low severity and limited exploitability of the flaw.