OpenSSH urgently patches a serious Alpine Linux vulnerability: a password over 256 bytes can break through SSH login
OpenSSH released emergency update 10.6p2 on November 5 to fix a flaw that lets an attacker log in with a 257- to 1,024-byte password without knowing the real one. It only triggers on servers running openssh-server without PAM, with password login enabled and a passwordless account — a combination Alpine Linux's default build meets. The bug matters because it turns a routine length check into a full authentication bypass on affected systems.
SOURCES
- IT之家2026-11-06 00:26
- Ars Technica2026-11-05 23:09
- LinuxDo2026-11-05 14:46