OpenSSH GSSAPI Key Exchange Flaw Exposes Systems to DoS and Information Disclosure

A flaw in OpenSSH's GSSAPI key exchange handling was disclosed on the oss-security mailing list and later tracked as CVE-2026-3497, with Red Hat describing the issue as an information disclosure or denial-of-service condition caused by uninitialized variables. The bug affects OpenSSH deployments that use GSSAPI authentication or key exchange, where improper handling of internal state can allow an attacker to trigger crashes or expose unintended memory contents under certain conditions.

Vendor tracking shows the issue moved from public disclosure into downstream remediation, with Red Hat opening Bugzilla case 2447085 for affected products. Separate references to Oracle Linux and a SonicWall advisory indicate vendors were also assessing or mapping related OpenSSH exposure in their own ecosystems, underscoring that the impact extends beyond a single distribution and requires organizations using GSSAPI-enabled SSH services to review patches and product advisories promptly.