Synology-SA-26:16 OpenSSH (sshole)
Publish Time: UTC+8
Last Updated: UTC+8
- Severity
- Not affected
- Status
- Resolved
Abstract
None of Synology's products are affected by CVE-2026-123158.
Affected Products
| Product | Severity | Fixed Release Availability |
|---|---|---|
| APM 2.0 | Not affected | N/A |
| APM 1.2 | Not affected | N/A |
| BeeStation OS 1.5 | Not affected | N/A |
| DSM 7.4 | Not affected | N/A |
| DSM 7.3 | Not affected | N/A |
| SRM 1.3 | Not affected | N/A |
| SRM 1.2 | Not affected | N/A |
Mitigation
None
Detail
- CVE-2026-123158
- Severity: Not affected
- CVSS3 Base Score: 8.1
- CVSS3 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CWE-394: Unexpected Status Code or Return Value
- sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
Reference
https://www.cve.org/CVERecord?id=CVE-2026-123158
Revision
| Revision | Date | Description |
|---|---|---|
| 1 | 2026-11-06 | Initial public release. |