CVE-2026-60000: 
Alma Linux vulnerability analysis and mitigation

CVE-2026-60000 is a denial-of-service vulnerability in OpenSSH's sshd daemon affecting all versions before 10.4. The flaw arises because MaxAuthTries is not properly enforced when GSSAPIAuthentication is enabled, allowing remote attackers to trigger excessive authentication attempts and exhaust server resources. It was publicly disclosed on July 8, 2026, coinciding with the release of OpenSSH 10.4. The NVD assigns a CVSS v3.1 base score of 7.5 (High), while the GitHub Advisory Database rates it 3.7 (Low) using a higher-complexity vector (GitHub Advisory, Red Hat Bugzilla, Openwall).

The root cause is classified under CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-307 (Improper Restriction of Excessive Authentication Attempts). When GSSAPIAuthentication is enabled in sshd (it is disabled by default), the MaxAuthTries configuration directive — which is intended to cap the number of authentication attempts per connection — is not correctly applied to GSSAPI authentication exchanges. This allows an unauthenticated remote attacker to send a large number of GSSAPI authentication requests within a single session without being disconnected, consuming CPU and memory resources on the server. The OpenSSH 10.4 release notes confirm that PerSourcePenalties would partially mitigate the impact even on unpatched systems, and that the issue was reported by Manfred Kaiser of milCERT AT (Austrian Ministry of Defence) (Openwall, GitHub Advisory).

Successful exploitation results in resource exhaustion (CPU and memory) on the targeted SSH server, degrading or denying SSH service availability to legitimate users. There is no impact on confidentiality or data integrity — the vulnerability is purely a denial-of-service condition. Because SSH is commonly used for remote administration, sustained exploitation could prevent administrators from accessing affected systems, potentially compounding the impact of concurrent incidents (GitHub Advisory, Red Hat Bugzilla).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.34–0.41%, placing it in the lower percentiles for near-term exploitation likelihood. Exploitation requires that GSSAPIAuthentication be enabled on the target server, which is off by default, limiting the exposed attack surface (Openwall, GitHub Advisory).

1. Reconnaissance: Identify SSH servers running OpenSSH versions prior to 10.4 using tools such as Shodan, Censys, or Nmap (nmap -sV -p 22). Check the SSH banner for version information.
2. Verify GSSAPI enabled: Attempt an SSH connection and observe whether GSSAPI authentication methods are advertised by the server (e.g., using ssh -v and inspecting the negotiated authentication methods).
3. Send excessive GSSAPI authentication attempts: Initiate an SSH session and repeatedly submit GSSAPI authentication tokens without completing authentication. Because MaxAuthTries is not enforced for GSSAPI, the server will process each attempt without disconnecting the client.
4. Exhaust server resources: By maintaining one or more connections and continuously sending GSSAPI authentication requests, an attacker can consume server CPU and memory, degrading or denying SSH service to legitimate users (Openwall, GitHub Advisory).

• Network: Unusually high volume of inbound SSH connections (TCP/22) from one or more source IPs; connections that remain open for extended periods without completing authentication.
• Logs: SSH daemon logs (/var/log/auth.log, /var/log/secure) showing repeated GSSAPI authentication attempts from the same source IP without successful login; entries such as Failed gssapi-with-mic or Invalid user appearing in rapid succession.
• Process/System: Elevated CPU or memory utilization by the sshd process without a corresponding increase in legitimate sessions; system load spikes correlated with inbound SSH traffic.
• Network: Connections that do not progress past the authentication phase and are not terminated after the expected number of failed attempts (Openwall, Red Hat Bugzilla).

The primary remediation is to upgrade OpenSSH to version 10.4 or later, which correctly enforces MaxAuthTries for GSSAPI authentication (Openwall). Linux distribution patches are available via Ubuntu (USN-8533-1) and Red Hat. As an immediate workaround for systems that cannot be patched promptly: (1) disable GSSAPIAuthentication in sshd_config by setting GSSAPIAuthentication no and restarting sshd — this eliminates the vulnerable code path entirely; (2) implement rate limiting on SSH connections at the firewall or using tools like fail2ban; (3) ensure PerSourcePenalties is enabled in sshd_config, as this provides partial mitigation even on unpatched versions (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was reported by Manfred Kaiser of milCERT AT (Austrian Ministry of Defence) and disclosed responsibly to the OpenSSH team, which addressed it in the 10.4 release (Openwall). Red Hat triaged the issue as medium severity and opened a tracking bug. Security news outlets such as SecurityOnline.info covered the OpenSSH 10.4 release and its security fixes. Community reaction has been measured given the low default exposure (GSSAPIAuthentication is off by default) and the absence of a public exploit.