CVE-2026-35387CWE-670

OpenSSH before 10.3 can use unintended ECDSA algorithms

Low · published April 2, 2026

CVSS v3.1
3.1
EPSS
0%
Percentile
41.6
In the wild
Unconfirmed
What it is

OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA algorithms.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00495 · 41.6th percentile
Weakness
CWE-670 · Always-Incorrect Control Flow Implementation
Published
2026-04-02T16:52Z
EPSS history
Timeline
  • 02 APR 16:52Z
    OpenSSH before 10.3 can use unintended ECDSA algorithms
    cvelistv5