CVE-2023-48795: The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, al

Q: How do I fix CVE-2023-48795?

openssh: upgrade to 9.6; putty: upgrade to 0.80; filezilla client: upgrade to 3.66.4. Exact commands for each OS are on this page.

Q: Is CVE-2023-48795 being exploited?

CVE-2023-48795 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2023-48795 affect?

CVE-2023-48795 affects openssh, putty, filezilla client. Severity is medium (CVSS 5.9). The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and

Q: How urgent is CVE-2023-48795?

Priority 61/100. EPSS top 1%: very likely to be exploited; Public exploit reference; Remotely exploitable, no login, no user action; On your watchlist

This week

MEDIUM 5.9REMOTEWATCHLISTUPGRADEUPGRADEUPGRADE

CVE-2023-48795 is a medium-severity flaw (CVSS 5.9) affecting openssh, putty, filezilla client. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP),

Why this priority

EPSS top 1%: very likely to be exploited
Public exploit reference
Remotely exploitable, no login, no user action
On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score	5.9 (Medium)
Attack vector	Network (remote)
Attack complexity	High
Privileges needed	None
User interaction	None
EPSS exploit chance	93.5% (top 1%)
CISA exploited list	No
Weakness	CWE-354
Published	2023-12-18
Last modified	2026-10-15

Publisher (CNA): MITRE · Vendor: filezilla-project · openbsd · panic · putty · roumenpetrov

Last updated 2026-10-15 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2023-12-18 16:15 UTCPublished CVE record published
2026-10-15 01:17 UTCUpdated Record last modified

openbsd openssh UPGRADE

Affected: < 9.6

Fixed in: 9.6

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy openssh || rpm -q openssh || openssh --version

2. UPGRADE to 9.6 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade openssh

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade openssh

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

putty putty UPGRADE

Affected: < 0.80

Fixed in: 0.80

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy putty || rpm -q putty || putty --version

2. UPGRADE to 0.80 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade putty

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade putty

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

filezilla-project filezilla client UPGRADE

Affected: < 3.66.4

Fixed in: 3.66.4

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy filezilla-client || rpm -q filezilla-client || filezilla-client --version

2. UPGRADE to 3.66.4 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade filezilla-client

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade filezilla-client

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

panic transmit 5 UPGRADE

Affected: < 5.10.4

Fixed in: 5.10.4

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy transmit-5 || rpm -q transmit-5 || transmit-5 --version

2. UPGRADE to 5.10.4 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade transmit-5

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade transmit-5

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

panic nova UPGRADE

Affected: < 11.8

Fixed in: 11.8

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy nova || rpm -q nova || nova --version

2. UPGRADE to 11.8 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade nova

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade nova

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

roumenpetrov pkixssh UPGRADE

Affected: < 14.4

Fixed in: 14.4

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy pkixssh || rpm -q pkixssh || pkixssh --version

2. UPGRADE to 14.4 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade pkixssh

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade pkixssh

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

Nuclei scan template: OpenSSH Terrapin Attack - Detection

Advisories and coverage

Official advisories

libssh2 Releases: 1.11.1 2024-10-16

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2023-48795?

openssh: upgrade to 9.6; putty: upgrade to 0.80; filezilla client: upgrade to 3.66.4. Exact commands for each OS are on this page.

Is CVE-2023-48795 being exploited?

CVE-2023-48795 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2023-48795 affect?

CVE-2023-48795 affects openssh, putty, filezilla client. Severity is medium (CVSS 5.9). The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and

How urgent is CVE-2023-48795?

Priority 61/100. EPSS top 1%: very likely to be exploited; Public exploit reference; Remotely exploitable, no login, no user action; On your watchlist

Software pages

OpenSSH vulnerabilities · PuTTY vulnerabilities · FileZilla vulnerabilities

Related CVEs

CVE-2026-55655 MEDIUM 5.0 MITIGATE MITIGATE A flaw was found in OpenSSH
CVE-2026-55653 MEDIUM 4.3 MITIGATE MITIGATE A flaw was found in OpenSSH
CVE-2026-60002 HIGH 7.7 UPGRADE ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchan
CVE-2026-60001 MEDIUM 6.5 UPGRADE sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.
CVE-2026-60000 LOW 3.7 UPGRADE sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from ex

References

← Back to latest CVEs