OpenSSH on musl Linux accepted any password over 256 chars since 2016
DanielLockyer · x · 2026-11-05
Daniel Lockyer disclosed that OpenSSH on musl-based Linux (Alpine, OpenWrt, Buildroot, Yocto, and many common Docker images) has had a bug since 2016: accounts that should never take a password at all — root, key-only deploy users, LDAP users, default users on Alpine's AWS/Azure images — accept any password longer than 256 characters.
Fixes: upgrade to OpenSSH 10.6p2 and/or disable PasswordAuthentication.
More from Safety
- OpenAI researcher: an AI security 'race to the top' is driving CVE disclosures — Eric_Wallace_ · 2026-11-06
- AI ethics researcher claims lab insiders coldly weigh catastrophe deaths against 'abundance' — LuizaJarovsky · 2026-11-06
- Firecracker VM escape disclosed: researchers claim root execution on the host — moyix · 2026-11-06
- Mustafa Suleyman flags 'deeply concerning' Delaware proposal for AI-run companies — mustafasuleyman · 2026-11-06
- Hugging Face open-sources safeagents, a local proxy that blocks reward-hacking tool calls — yb2698 · 2026-11-06
- Pinokio 8.3.7 ships security-first architecture after eMudhra certificate breach — cocktailpeanut · 2026-11-06