OpenSSH 10.6p2 Alpine PAM workaround
The gist
OpenSSH released Portable OpenSSH 10.6p2 to patch a flaw letting long passwords bypass SSH login on Alpine Linux.
Servers using musl libc without PAM should update or disable password login now.
How it unfolded
- Oct 6, 2026OpenSSH 10.6 / 10.6p1 released, the prior version that 10.6p2 later patches.
- Nov 5, 2026Portable OpenSSH 10.6p2 released with a workaround; sshd now refuses a match when the stored password field is shorter than four characters.
- Nov 5, 2026Alpine published fixed packages for every release back to 3.16, including unsupported branches; point releases 3.21.10, 3.22.8, 3.23.8 and 3.24.4 already include the fixed package.
Key terms
- PAM
- A mechanism that integrates multiple low-level authentication schemes into a high-level API, letting programs authenticate independently of the underlying scheme.
- musl libc
- A lightweight C standard library for Linux-based systems, released under the MIT license and aimed at embedded and mobile devices.
- sshd
- A suite of secure networking utilities based on the SSH protocol that provides encrypted communication over insecure networks.
Source: Wikipedia