CVE-2026-73282

mediumCVSS 4.8covered by 2 sourcesfirst seen 2026-08-11

In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.

CSIRTS triage

What: Use-after-free in ssh when realloc occurs during concurrent remote-forwarding operations.
Who is affected: Deployments running OpenSSH versions before 10.5 are affected.
Urgency: Medium severity (CVSS 4.8) requiring specific operational conditions for exploitation; patch within standard maintenance windows.
Action: Upgrade OpenSSH to version 10.5 or later.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch CVE-2026-73282

Get an email if CVE-2026-73282 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Low exploitation risk0.16% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all EPSS-scored CVEs.

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-73282 status](https://www.csirts.com/badge/CVE-2026-73282)](https://www.csirts.com/cve/CVE-2026-73282)