CVE-2024-39894: OpenBSD OpenSSH

High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days.

OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password entry (e.g., for su and Sudo) because of an ObscureKeystrokeTiming logic error. Similarly, other timing attacks against keystroke entry could occur.

Affected products

• OpenBSD OpenSSH: from 9.5, up to and including 9.7

Published 2024-07-02. Last modified 2026-06-17.