Cyber ·
Claimed password-auth bypass in OpenSSH with musl libc and raw records published
oss-sec mailing list post dated 7 November 2026: the author published 82,236 lines of measurements to support a claimed password authentication bypass in OpenSSH on musl libc systems. The source does not confirm the claim's validity.
The post is a follow-up on the oss-sec list to an earlier message about measurements taken the night before. The author says that questions arose, mostly in private channels, about whether those numbers were really measured, and therefore published the complete raw record as a public archive. According to the description, the package has 82,236 lines, including the output of a crypt() census, end-to-end timing measurements of sshd on two systems (one with mixed accounts and one with all accounts locked), each data file with a timestamp and SHA-256, and the harness sources. The text received is truncated, so no further details on methodology or conclusions can be stated. This is a security claim still under discussion: the presence of raw data does not by itself prove the issue exists. To verify, consult the original message on the oss-sec list, follow responses from the OpenSSH and musl libc maintainers, and compare the SHA-256 hashes of the published files with those of your downloaded copy.
Original source: Re: “sshole”: bypass de autenticação por senha em OpenSSH + musl libc