OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux

A critical vulnerability in OpenSSH allows attackers to bypass SSH authentication on Alpine Linux servers running the standard openssh-server package. The flaw enables login to accounts with no password, including SSH key-only accounts, using a password between 257 and 1,024 bytes long. Attackers only need network access, a valid account name, and the specially sized password to exploit the issue. OpenSSH has rated the vulnerability as critical and released version 10.6p2 as an emergency fix. Alpine Linux has also published patched packages for all affected versions. The vulnerability is particularly dangerous as it undermines key-based authentication, a widely trusted security mechanism.