{
  "cveId": "CVE-2026-56452",
  "url": "https://patchblox.com/security/cve/CVE-2026-56452",
  "summary": "CVE-2026-56452 is fixed in apache-sshd on 1 platform, first by SUSE-SU-2026:3339-1, released July 28, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "apache-sshd: This update for apache-sshd fixes the following issues:\n\nUpdate to upstream version 2.19.0.\n  \nSecurity issues fixed:...",
  "description": "This update for apache-sshd fixes the following issues:\n\nUpdate to upstream version 2.19.0.\n  \nSecurity issues fixed:\n\n- CVE-2026-56452: remote users can use SCP to send filenames that lead to arbitrary file writes due to a path traversal\n  issue in the \u0060sshd-scp\u0060 component of Apache MINA SSHD. (bsc#1272158).\n- CVE-2026-56623: remote users can obtain access to git repositories outside of the configured server-side root\n  directory on Windows systems due to path traversal issue in \u0060org.apache.sshd:sshd-git\u0060 (bsc#1271993).\n- CVE-2026-56624: users can authenticate with certificates containing the \u0060force-command\u0060 option but still execute\n  other commands due to improper validation of certificate options in Apache MINA SSHD  (bsc#1271992).\n- CVE-2026-58624: remote execution of JGit commands can lead to arbitrary file writes due to improper input validation\n  in \u0060sshd-git\u0060 of Apache MINA SSHD (bsc#1271991).\n\nOther updates and bugfixes:\n\n- Version 2.19.0:\n  * Bug Fixes\n    \u002B GH-899 Fix ProcessShellFactory on Linux.\n    \u002B GH-902 Fix client-side handling of sk-* public key signatures (also in the agent interfaces).\n    \u002B Limit size of decompressed SSH packets.\n    \u002B Improve checking SSH user certificates in public-key authentication.\n    \u002B Improve handling of repository paths in sshd-git on Windows.\n    \u002B Validate file names in SCP.\n    \u002B Escape newlines in filenames in the SCP protocol.\n    \u002B Restrict JGit commands accessible via GitPgmCommandFactory in sshd-git.",
  "published": "2026-07-28T10:03:18Z",
  "severity": "",
  "epss": 0.00772,
  "epssPercentile": 0.56014,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "apache-sshd",
      "release": "sles 15.6",
      "fixedVersion": "2.19.0-150200.5.16.1",
      "fix": "SUSE-SU-2026:3339-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3339-1",
      "released": "2026-07-28T10:03:18Z"
    },
    {
      "platform": "linux",
      "product": "apache-sshd",
      "release": "sles 15.7",
      "fixedVersion": "2.19.0-150200.5.16.1",
      "fix": "SUSE-SU-2026:3339-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3339-1",
      "released": "2026-07-28T10:03:18Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-10T20:03:11Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}