#375 — Nov 7, 2026 by Evan Chen

I'm a day late hearing about CVE-2026-123158, described by https://sshhole.com/ as follows:

so openssh on musl linux (alpine, openwrt, buildroot, yocto, and a lot of the docker images you've pulled) has had a little problem since 2016.

accounts that should never take a password at all (root, your key-only deploy user, ldap users, the default user on alpine's aws and azure images) take any password longer than 256 characters.

yes, any password. yes. i know. yes.