CVE-2026-3497: ubuntu linux 25.10, 20.04, 22.04 (+1 more affected versions); +39 more affected products

Affected technology

ubuntu linux · 25.10
canonical

openssh · Version not applicable in the source CPE
openbsd

ubuntu linux · 20.04
canonical

ubuntu linux · 22.04
canonical

ubuntu linux · 24.04
canonical

debian linux · 11.0
debian

enterprise linux · 8.0
redhat

enterprise linux · 9.0
redhat

enterprise linux · 10.0
redhat

openssh · 1:10.0p1-5ubuntu5 to before 1:10.0p1-5ubuntu5.1, 1:9.6p1-3ubuntu13 to before 1:9.6p1-3ubuntu13.15, 1:8.9p1-3 to before 1:8.9p1-3ubuntu0.14
Ubuntu

Red Hat Enterprise Linux 10 · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 10.0 Extended Update Support · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 8 · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 8.6 Telecommunications Update Service · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 8.8 Telecommunications Update Service · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 9 · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 9.4 Extended Update Support · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 9.6 Extended Update Support · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Container Platform 4.12 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Container Platform 4.13 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Container Platform 4.14 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Container Platform 4.15 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Container Platform 4.16 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Container Platform 4.17 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Container Platform 4.18 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Container Platform 4.19 · Exact affected versions not specified by the source
Red Hat

RHEL-8 based Middleware Containers · Exact affected versions not specified by the source
Red Hat

Red Hat AI Inference Server 3.2 · Exact affected versions not specified by the source
Red Hat

Red Hat AI Inference Server 3.3 · Exact affected versions not specified by the source
Red Hat

Red Hat Hardened Images · Exact affected versions not specified by the source
Red Hat

Red Hat Update Infrastructure 5 · Exact affected versions not specified by the source
Red Hat

Multicluster Engine for Kubernetes · Exact affected versions not specified by the source
Red Hat

OpenShift Pipelines · Exact affected versions not specified by the source
Red Hat

Red Hat Advanced Cluster Management for Kubernetes 2 · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 6 · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 7 · Exact affected versions not specified by the source
Red Hat

SIMATIC S7-1500 CPU 1518-4 PN/DP MFP · V3.1.6 to before *
Siemens

SIMATIC S7-1500 CPU 1518-4 PN/DP MFP · V3.1.7 to before *
Siemens

SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP · V3.1.6 to before *
Siemens

SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP · V3.1.7 to before *
Siemens

SIPLUS S7-1500 CPU 1518-4 PN/DP MFP · V3.1.6 to before *
Siemens

SIPLUS S7-1500 CPU 1518-4 PN/DP MFP · V3.1.7 to before *
Siemens

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An attacker can send an unexpected GSSAPI message type during the GSSAPI key exchange to the server, which will call the underlying function and continue the execution of the program without setting the related connection variables. Vendor/CNA’s CVSS 4.0 assessment (base score 6.9/10) rates confidentiality impact as none; integrity and availability impact as low.