UBUNTU-CVE-2026-35388

Details

OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.

Affected Packages(23 packages)

openssh-ssh1

Ubuntu 18.04 LTS

Affected versions:

1:7.5p1-101:7.5p1-81:7.5p1-91:7.5p1-9build1

openssh-ssh1

Ubuntu 20.04 LTS

Affected versions:

1:7.5p1-11build1

openssh

Ubuntu 22.04 LTS

Fixed in:

1:8.9p1-3ubuntu0.15

openssh-ssh1

Ubuntu 22.04 LTS

Affected versions:

1:7.5p1-121:7.5p1-12build11:7.5p1-13

openssh

Ubuntu 24.04 LTS

Fixed in:

1:9.6p1-3ubuntu13.16

openssh-ssh1

Ubuntu 24.04 LTS

Affected versions:

1:7.5p1-141:7.5p1-151:7.5p1-15build11:7.5p1-16

openssh

Ubuntu 25.10

Fixed in:

1:10.0p1-5ubuntu5.4

openssh-ssh1

Ubuntu 25.10

Affected versions:

1:7.5p1-17

openssh

Ubuntu 26.04 LTS

Fixed in:

1:10.2p1-2ubuntu3.2

openssh-ssh1

Ubuntu 26.04 LTS

Affected versions:

1:7.5p1-171:7.5p1-18

References

REPORT

https://ubuntu.com/security/CVE-2026-35388

ADVISORY

https://ubuntu.com/security/notices/USN-8222-1

REPORT

https://www.cve.org/CVERecord?id=CVE-2026-35388