OpenSSH 10.6 Enables ML-DSA Post-Quantum Signatures and Fixes an sftp Path Traversal

OpenSSH 10.6 Enables ML-DSA Post-Quantum Signatures and Fixes an sftp Path Traversal

By Our editorial standards

OpenSSH 10.6 was released on October 6, two months after OpenSSH 10.5.

Security fixes

  • sftp: paths returned by a server are validated more strictly, so a malicious server can no longer steer a recursive download outside the target directory
  • Compression: the LZ77 dictionary coder is disabled to mitigate a cross-channel plaintext recovery attack. Compression still works but is less effective
  • ssh rejects usernames given on the command line that contain $ or \, preventing shell injection through ProxyCommand and Match exec
  • sshd GSSAPI credentials are stored only after successful authentication
  • The restrict keyword in authorized_keys now fully applies to tunnel forwarding
  • ssh-keygen fixes a daylight saving time bug that could make certificate expiry times off by an hour

Post-quantum signatures

The hybrid ssh-mldsa44-ed25519 signature algorithm, which pairs ML-DSA-44 with Ed25519, is now enabled under its final name. Keys made with the earlier experimental @openssh.com variant must be regenerated.

A new WarnWeakCrypto option in sshd_config, on by default, logs when a client connects using key exchange that is not post-quantum safe. Expect new log lines from older clients.

Other new features

  • AgentSocketPath in sshd and ssh-agent -A control where agent sockets live
  • sftp supports mkdir -p
  • ssh-add -P skips PIN entry for tokens that do not need it, and FIDO resident keys keep their user-verification requirement
  • TCPKeepAlive all also applies keepalives to forwarded connections
  • ssh -I shows local and remote version strings

Deprecations

scp -R now prints a deprecation warning and will eventually be ignored. Our scp, sftp, and rsync guide covers the alternatives.

Your distribution will ship the fixes in its own OpenSSH packages. The source is on our OpenSSH 10.6 download page, and our SSH hardening guide covers the settings that matter most.

More news

OpenSSH 10.5 Patches an Agent Locking Bypass, and the Project Changes How It Ships Security FixesOpenSSH 10.5 fixes an interaction between ssh-agent locking and session-bind that let remote operations slip through a forwarded agent. The bigger story is the project's decision to release more often because AI-assisted vulnerability reports are arriving faster than the old schedule can absorb.Kernel Cryptography Gets a Library API, Fixing Decades of Fragile Crypto API UsageAt Linux Security Summit North America 2026, Eric Biggers detailed ongoing progress modernizing the kernel's cryptography framework: new library APIs that let kernel code call cryptographic functions directly, without the traditional crypto API's request-object and callback plumbing that has long been a source of subtle bugs.Go 1.27 Ships Generic Methods, a New JSON Engine, and Goroutine Leak ProfilingGo 1.27 lands with method-level type parameters, encoding/json/v2 backing the standard JSON package, a generally available goroutine leak profile, faster small allocations, and post-quantum ML-DSA signatures.

Background reading

Explainers for the concepts behind this story.

The First Ten Minutes on a New Linux ServerA fresh VPS is reachable from the entire internet within seconds of provisioning. Here is the short, ordered list of things to do before you install anything else.SSH Hardening GuideSSH is the most commonly attacked service on internet-facing Linux servers. This guide covers every important sshd_config setting, key management practices, and tools like fail2ban to reduce your exposure.Malware Scanning on Linux: ClamAV, rkhunter, and Lynis ComparedThree different tools that are often lumped together as Linux antivirus. What ClamAV, rkhunter, chkrootkit, and Lynis each actually detect, how to run them, how to read their false positives, and when scanning is worth it.