OpenSSH 9.8p1 is affected by the vulnerabilities in DFN-CERT advisories
2026-5120 and 2026-5521, among them

*   CVE-2026-35386: command execution via shell metacharacters in user
    names (fixed in 10.3p1)
*   CVE-2026-60002: use-after-free in ssh when a server changes its
    host key during re-exchange (fixed in 10.4p1)
*   CVE-2026-73282: use-after-free with concurrent remote forwardings
    (fixed in 10.5p1)

and by the older CVE-2025-26465 (VerifyHostKeyDNS server impersonation)
and CVE-2025-26466 (pre-authentication memory/CPU denial of service),
fixed in 9.9p2. 10.6p1 is the latest release.

OpenSSH 10.0p1 removed DSA support altogether, so drop
`--enable-dsa-keys`, which configure now only warns about:

    configure: WARNING: unrecognized options: --enable-dsa-keys

Deploying this needs care:

1.  The site configuration in mxtools still contains
    `PubkeyAcceptedKeyTypes=+ssh-dss` (sshd_config, ssh_config) and
    `HostKeyAlgorithms=+ssh-dss` (ssh_config). OpenSSH 10.6p1 rejects
    both, so sshd refuses to start and ssh refuses to run:

        sshd_config line 124: Bad key types '+ssh-dss'.
        ssh_config line 58: Bad key types '+ssh-dss'.
        ssh_config line 62: Bad key types '+ssh-dss'.
        ssh_config: terminating, 2 bad configuration options

    Without these lines both files pass `sshd -t` and `ssh -G` with
    9.8p1 as well as 10.6p1, so the mxtools change can go out first.

2.  A running 9.8p1 sshd cannot hand connections to the 10.6p1
    sshd-session installed under it. New logins fail until sshd is
    restarted:

        recv_rexec_state: ssh_msg_recv failed

    (client: `kex_exchange_identification: read: Connection reset by
    peer`). Restart sshd right after installing the package.

3.  sshd 10.0p1 and later no longer offer finite field Diffie-Hellman
    key exchange by default, and the new sshd-auth binary is installed
    to /usr/libexec next to sshd-session.

Built with beesh against a local copy of the upstream tarball; the
signature verifies with the OpenSSH release key 7168B983815A5EEF.

Assisted-by: claude-opus-5.5 (Claude Code)