# OpenSSH flaw allows oversized passwords to bypass some login restrictions

_Published Tuesday, November 10, 2026 at 7:07 AM EST · Security · Latest · Tier 2 — Notable_

A newly disclosed flaw involving OpenSSH and musl lets attackers log in to certain Linux accounts configured to block password authentication, Schneier on Security reports. The vulnerability, dubbed "*sshole," affects certain accounts on Alpine Linux and other Linux systems based on musl.

Attackers can bypass the restriction by entering a password longer than 256 bytes. The flaw has been in the code for a decade.

## Sources

- [Schneier on Security](https://www.schneier.com/blog/archives/2026/11/new-openssh-vulnerability.html)

---
Canonical: https://techandbusiness.org/newswire/MuGYGtPHRa7zYee-29RmJR
Published: 2026-11-10T12:07:19.042Z
Story chronology: 2026-11-10T12:02:38.000Z
Retrieved: 2026-11-10T14:20:26.507Z
Publisher: Tech & Business (techandbusiness.org)