OpenSSH Accepted a 300-Byte Password for Accounts With No Password. The Bug Is in musl and Alpine's Shadow File

Sat, 07 Nov 2026 08:30:00 +0530

A password of 257 to 1024 bytes will log in to any account whose /etc/shadow field is *, on an sshd that is linked against musl and runs without PAM. That is CVE-2026-123158, nicknamed “sshole” by its reporter, Özgün Kültekin of Wakefield. OpenSSH shipped 10.6p2 on November 5 with a workaround, and Alpine published fixed packages for every branch from 3.16 to edge the same day.

The interesting part is that no single component is wrong in isolation. Two decisions made years apart agree on one character.

Openssh on Kuldeep Pisda

OpenSSH Accepted a 300-Byte Password for Accounts With No Password. The Bug Is in musl and Alpine's Shadow File