Decade-old *sshole flaw lets attackers log into password-disabled Linux accounts via oversized passwords
Vulnerability in OpenSSH and musl libc affects Alpine Linux and other distros; patch available in OpenSSH 10.6p2
A vulnerability dating back to 2016, dubbed *sshole, allows attackers to log into certain Linux accounts configured to block password authentication simply by entering a password longer than 256 bytes. The flaw affects OpenSSH running on systems using the musl C library, such as Alpine Linux, OpenWrt, Buildroot, and Yocto, under specific authentication configurations. Security researcher Özgün Kültekin disclosed the vulnerability today and said it was discovered using AI agents that ran about 17,600 authentication tests. A fix has been released in OpenSSH 10.6p2.