Science & Tech · Cybersecurity · 2 hrs ago
OpenSSH flaw lets long passwords access some musl-based Linux accounts
A flaw dubbed sshole affects some OpenSSH servers running on Linux systems that use the musl C library, including Alpine Linux.
Attackers can exploit it by entering a password between 257 and 1,024 characters long to access certain accounts marked as unable to accept password logins.
The attack requires specific settings, including password authentication being enabled, PAM being disabled, an account marked with an asterisk, and another account with a valid password hash.
The problem traces to an OpenSSH change from 2016 and how musl handles password-hashing errors.
Some Alpine cloud images may be at risk, because an affected account can have passwordless doas access that could let an attacker become root.
Systems using glibc or PAM authentication are not affected, and no attacks exploiting the flaw have been reported.
Administrators should update OpenSSH or disable SSH password logins until they can install the fix; Alpine has also issued fixed packages.
A flaw dubbed *sshole let attackers log in to certain password-disabled accounts on some Linux systems using an oversized SSH password.
The flaw affects systems using musl libc when OpenSSH runs without PAM, password authentication is enabled, and specific account-password conditions are met.
Attackers can use passwords between 257 and 1,024 bytes, but the flaw does not bypass valid password hashes.
OpenSSH fixed the vulnerability in version 10.6p2, and Alpine Linux published fixed packages for its releases back to 3.16.
Administrators can reduce risk by disabling SSH password authentication or updating affected packages and restarting the SSH server.
- Who
- Attackers with network access and the name of an account that has no password.
- What
- A flaw called *sshole let oversized passwords authenticate to some password-disabled accounts on affected systems.
- When
- The flaw dates to 2016; it was disclosed and fixed on November 5, 2026.
- Where
- Certain Linux systems using musl libc, including Alpine Linux; other potentially affected systems include OpenWrt, Buildroot, and Yocto.
- Why
- A musl password-hashing failure can return an asterisk that matches the marker used for accounts without password hashes.
This story does not have two clearly opposing sides.
OpenSSH changed password handling to reduce the risk of attackers identifying valid usernames through different response times.
Özgün Kültekin disclosed the flaw, and OpenSSH released version 10.6p2 to block it.
Alpine Linux published fixed packages for releases back to 3.16.
- Vulnerability
- *sshole
- Affected password length
- 257 to 1,024 bytes
- OpenSSH fix
- Version 10.6p2
- Alpine package fix coverage
- Releases back to 3.16
- Authentication requirements
- PAM disabled and SSH password authentication enabled
6 sources
Meet *sshole, the vulnerability that lets hackers SSH into Linux devices
Security vulnerability discovered in OpenSSH on musl-based Linux systems
Get root on a musl Linux system by slamming it with an overly long password
Combined OpenSSH and musl-libc flaws let anyone into Alpine Linux and other distros by typing anything over 256 characters as a password
OpenSSH flaw lets attackers log into password-disabled Linux accounts
OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux
What people are saying
set PasswordAuthentication=no or disable SSH for these systems IMMEDIATELY