CVE-2010-5107: OpenBSD OpenSSH

High severity, CVSS 7.5. EPSS: 16.5% chance of exploitation in the next 30 days.

The default configuration of OpenSSH through 6.1 enforces a fixed time limit between establishing a TCP connection and completing a login, which makes it easier for remote attackers to cause a denial of service (connection-slot exhaustion) by periodically making many new TCP connections.

Affected products

• OpenBSD OpenSSH: up to and including 6.1; version 1.2 only; version 1.2.1 only; version 1.2.2 only; version 1.2.3 only; version 1.2.27 only; …

Published 2013-03-07. Last modified 2026-06-16.