OpenSSH 10.5 Released with Security Fixes and More Frequent Updates

OpenSSH 10.5 Release

OpenSSH 10.5 was released on August 11, 2026. This version is available from the official OpenSSH mirrors and includes a number of security and small bug fixes. OpenSSH provides a complete SSH protocol 2.0 implementation, including sftp client and server support.

Response to AI-Assisted Bug Reports

The OpenSSH team has observed a significant increase in security bug reports, many generated or assisted by AI models. While some AI-identified issues lack realistic security impact, the team welcomes these reports, especially when combined with human analysis and proposed fixes. The independent discovery of AI-identified bugs by other researchers suggests potential exploitation by adversaries.

Shift to More Frequent Releases

In response to the volume of security findings, the OpenSSH team will now make more frequent releases. This strategy aims to deliver bug fixes to users more rapidly, rather than batching them for less frequent, planned releases. This change is a direct result of the increased rate of security vulnerability identification.

Potentially Incompatible Changes

Portable OpenSSH in version 10.5 now mandates Elliptic Curve Cryptography (ECC) support within libcrypto, specifically including support for the NISTP521 curve. This requirement applies to default build configurations of supported libcrypto implementations such as LibreSSL, OpenSSL, BoringSSL, and AWS LC, but does not affect the --without-openssl build configuration.

Key Security Fixes

Security fixes in this release include an agent locking interaction fix in ssh-agent(1) that prevented session-bind@openssh.com extension requests from being refused when the agent was locked. This issue could allow remote operations intended for local use, such as adding PKCS#11 tokens or using keys with destination restrictions. Additionally, ssh(1) addresses a potential realloc use-after-free vulnerability in the client related to remote forwarding.