CVE-2026-109786

5.3Medium

Published 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

5.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-117

Impact

Remote unauthenticated attackers can cause a denial of service by banning arbitrary IP addresses from SSH access. They only need network connectivity to the target's exposed SSH port to inject crafted usernames.

Root cause

The sshd filter in fail2ban permits an 'on <token>' suffix after the host address, letting attackers forge log entries via verbatim username logging in OpenSSH.

Affected systems

fail2ban 0.10.5 through 1.1.1 (before commit ddd879d)

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Fix & remediation

Upgrade fail2ban to a version including commit ddd879d or newer. As an interim workaround, adjust config/filter.d/sshd.conf to avoid matching the arbitrary 'on <token>' suffix in regex patterns or disable the sshd jail.

shell

$ sudo apt-get update && sudo apt-get install --only-upgrade fail2ban

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter (config/filter.d/sshd.conf) accepts an "on <token>" suffix after the host address. Because OpenSSH logs the offered username verbatim, a remote unauthenticated attacker can use a username such as "x VICTIM-SOURCE-IP-ADDRESS on" to make fail2ban associate failed login attempts with an arbitrary source IP address and ban it (e.g., to block logins from a legitimate user). The default filter mode is affected.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109786