{
  "id": 18353239,
  "title": "Combined OpenSSH and musl-libc flaws let anyone into Alpine Linux and other distros by typing anything over 256 characters as a password",
  "url": "https://urgent.news/2026/11/05/combined-openssh-and-musl-libc-flaws-let-anyone-into-alpine-linux-and",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-05T18:14:56.000Z",
  "source": {
    "name": "Tom's Hardware",
    "slug": "tom-s-hardware",
    "url": "https://www.tomshardware.com/tech-industry/cyber-security/combined-flaws-let-anyone-into-alpine-linux-and-other-distros-by-typing-anything-over-256-characters-as-a-password-emergency-fixes-for-openssh-and-musl-libc-issued-for-millions-of-systems-patch-immediately"
  },
  "original_language": "en",
  "account": "A pair of software bugs affecting the OpenSSH and musl-libc libraries have created a security flaw allowing unauthorized access to various Linux distributions, including Alpine, OpenWRT, and others. By simply typing over 256 characters as a password, an attacker can bypass the authentication process and gain access to the system. This issue is particularly concerning for Alpine Linux, as it is often used as the default choice for many installations, including Docker/Kubernetes/Proxmox containers, servers, cloud VMs, and embedded devices.\n\nThe vulnerability stems from a combination of factors: OpenSSH, musl, password authentication not disabled, not using PAM, and the presence of a single user account with a set password using a SHA-512/256 hash. Once an attacker exploits this vulnerability, they can access the system without needing any credentials, regardless of whether the target system is connected to the internet or not. In fact, any individual with a valid user account within a network can potentially exploit this flaw, making it a significant concern for organizations with large user bases.\n\nThe developers of OpenSSH and musl-libc have released patches and advisories to address the issue, but it is crucial for system administrators to apply the updates as soon as possible to mitigate the risk of unauthorized access. A simple mitigation strategy involves explicitly setting PasswordAuthentication to \"no\" in the OpenSSH configuration file and restarting the service. However, this may not be feasible for all environments, particularly those that require password authentication for security and access control purposes.\n\nIn summary, the combined OpenSSH and musl-libc bugs present a serious security risk to numerous Linux distributions, primarily affecting Alpine Linux and other popular systems. System administrators should prioritize applying the recommended patches and mitigations to prevent potential unauthorized access and protect their networks and systems from exploitation.",
  "summary": null,
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 4,
    "also_reported_by": [
      {
        "outlet": "LWN",
        "title": "Critical security vulnerability affects OpenSSH on Alpine Linux systems",
        "url": "https://urgent.news/2026/11/05/critical-security-vulnerability-affects-openssh-on-alpine-linux",
        "published": "2026-11-05T11:39:10.000Z"
      },
      {
        "outlet": "Hacker News",
        "title": "Alpine Linux Security advisory: OpenSSH-server password authentication bypass",
        "url": "https://urgent.news/2026/11/05/alpine-linux-security-advisory-openssh-server-password-authentication",
        "published": "2026-11-05T14:44:20.000Z"
      },
      {
        "outlet": "The Register Science",
        "title": "Get root on a musl Linux system by slamming it with an overly long password",
        "url": "https://urgent.news/2026/11/05/get-root-on-a-musl-linux-system-by-slamming-it-with-an-overly-long",
        "published": "2026-11-05T18:29:00.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}