CVE-2026-55653: OpenSSH DH-GEX Client Path Double-Free in FIPS Known-Group Validation

HERMES

HERMES THREAT SCORE & SYSTEM ATTACK SURFACE

Target: OpenSSH (kexgexc.c)

Confidence: 94%

70 / 100

MEDIUM

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 18 / 20

Threat Activity 16 / 20

Weaponization 17 / 20

Exposure 18 / 20

Prevalence 19 / 20

Impact 18 / 20

Exploit Maturity 17 / 20

Attack Chain Potential 19 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-55653 at 4.3 (MEDIUM, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L). The Hermes Threat Score evaluates operational impact at 70 (MEDIUM) reflecting enterprise infrastructure exposure.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-55653: OpenSSH DH-GEX Client Path Double-Free in FIPS Known-Group ValidationVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTOpenSSH Suite

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in OpenSSH Suite documented in Hermes dossier.”

Supporting Verified Evidence:

[vulnerability_report]
[government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

1. Technical Context & Affected Software Matrix

The vulnerable software component OpenSSH (kexgexc.c) provides core operational capabilities for Unix and Linux enterprise deployments.

Parameter	Technical Specification	Threat Intelligence Context
CVE Identifier	`CVE-2026-55653`	Official Upstream Security Release
Affected Product	`openssh:openssh`	Core Infrastructure Component
Vulnerable Component	`OpenSSH (kexgexc.c)`	System Library / Daemon / Emulator
Weakness Class	`CWE-415: Double Free`	Security Control / Memory Safety Flaw
CVSS v3.1 Score	4.3 (MEDIUM / Hermes Score 70)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L`
Fixed Version	`10.3p1`	Upstream patch release
MITRE ATT&CK	T1499 - Endpoint Denial of Service, T1557 - Adversary-in-the-Middle	Privilege Escalation / Defense Evasion
Forensic Cross-Reference	Linux Process Crash and Memory Corruption Forensics	Artifact analysis and trace investigation

2. In-Depth Technical Decomposition & Root Cause

Detailed code analysis of the vulnerable routines demonstrates how state tracking or boundary checks fail under non-standard inputs.

// Bug in kexgexc.c (kexgex_client)
int kexgex_client(struct ssh *ssh)
{
    BIGNUM *p = NULL, *g = NULL;
    ...
    if (fips_mode() && !validate_fips_dh_group(p, g)) {
        BN_clear_free(p); // First free of BIGNUM p
        /* VULNERABILITY: p pointer is not set to NULL */
        r = SSH_ERR_INVALID_ARGUMENT;
        goto out; // 'out' calls BN_clear_free(p) again!
    }
    ...
out:
    BN_clear_free(p);
    return r;
}

Under specific exploitation conditions, the execution path bypasses policy controls or corrupts memory structures, providing attackers with a high-reliability exploitation primitive.

3. Attack Scenarios & Threat Modeling

Initial Vector & Preconditions: A malicious SSH server or network interceptor returns invalid DH-GEX group parameters when a FIPS-compliant automated backup worker or administrative client connects.
Triggering Primitive: The attacker executes crafted parameters or issues unexpected network requests targeting OpenSSH (kexgexc.c).
Control Bypass / Memory Violation: VULNERABILITY: p pointer is not set to NULL.
Impact Realization: The client immediately crashes with SIGABRT due to the double-free, disrupting critical synchronization and administrative channels..

4. Forensic Detection, Artifacts & System Logs

Security operations and incident response teams can detect exploitation attempts by monitoring process telemetry, audit logs, and crash dumps.

System Logs & Telemetry

Monitor system logs for indicators matching: ssh[pid]: double free or corruption (fasttop) / coredump generated. Look for unexpected aborts or anomalous system call patterns.

Auditd & Process Tracing

Deploy targeted audit rules to trace suspicious command sequences. Consult Linux Process Crash and Memory Corruption Forensics.

title: OpenSSH Client DH-GEX FIPS Validation Double Free Crash
id: cve-2026-55653
status: experimental
description: Detects exploitation artifacts and crash signatures for CVE-2026-55653.
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        - 'ssh[pid]:'
        - 'openssh'
    condition: selection
fields:
    - CommandLine
    - User
level: high

# Monitor invocations associated with openssh:openssh
sudo bpftrace -e '
kprobe:kexgexc.c {
    printf("PID %d (%s) invoked target function\n", pid, comm);
}'

5. Remediation & Hardening Guidelines

Protecting infrastructure against CVE-2026-55653 requires applying vendor security updates and enforcing least-privilege configurations:

Software Update: Upgrade openssh:openssh packages to version 10.3p1 or higher via your operating system package manager.
Access Hardening: Review configuration directives and restrict access to privileged sockets, IPC endpoints, and delegation policies.
Forensic Preparedness: Refer to our dedicated guide on Linux Process Crash and Memory Corruption Forensics for forensic procedures and logging best practices.