⚡Alpine Linux has issued a security advisory for an OpenSSH server password-authentication bypass vulnerability.

What it means

Alpine Linux has released a security advisory for a password-authentication bypass in OpenSSH's server when built against the musl C library (Alpine's default). In affected versions, sending an overly long password — reported as more than 256 bytes — can cause sshd to accept the login even when the password is wrong, so password-enabled SSH accounts become remotely bypassable. Fixed Alpine point releases (3.21.10, 3.22.8, 3.23.8, 3.24.4) and an upstream OpenSSH emergency release (10.6p2) address it; the immediate mitigation is disabling password authentication.

Accuracy & sourcesGrounded

The claim is directly grounded in Alpine's official security advisory, and independent coverage (The Register, The Hacker News) aligns on the mechanism and on the upstream OpenSSH 10.6p2 fix. Exact affected package versions and exposure scope are laid out in the advisory itself.

How new

Genuinely new as of this coverage wave: the advisory was published 2026-11-05 and same-day reports treat it as a fresh vulnerability, with no recirculation year given.

Go deeper