ANT-2026-2NNMB24E · openssh

stack-overflow low

Severity Claude critical · Security research firm low · Maintainer -

Discovered by Claude Mythos Preview

REPORT

Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Calif.

ANT-2026-2NNMB24E: stack-overflow in openssh

OpenSSH's match_pattern() in match.c performs unbounded recursion when handling wildcard patterns. The function is reachable from ssh-keygen -Y find-principals via sshsig_find_principals -> check_allowed_keys_line -> cert_filter_principals, where it matches certificate principals (from the attacker-supplied signature) against principal patterns (from the attacker-supplied allowed_signers file). By supplying a certificate with a ~400,000-character principal and an allowed_signers entry containing ~200,000 repetitions of '*?', an attacker triggers hundreds of thousands of recursive calls and exhausts the stack. The result is a deterministic crash (DoS) of ssh-keygen.

Target

Project: openssh
Commit: 9a50a84f55acd8b7
Location: match.c:92

Technical Details

ASAN: 'stack-overflow on address 0x7ffe2411fff8 ... in match_pattern /workspace/repo/match.c:92'. Each '' in the pattern causes match_pattern() to recurse while scanning the remaining string; a pattern of the form '???...' forces one new recursion level per '*?' pair with no depth cap. When the string is long enough to keep each recursive scan alive, recursion depth is bounded only by pattern length, leading to stack exhaustion.

Crash trace:

Triggering stack overflow in ssh-keygen...
AddressSanitizer:DEADLYSIGNAL
=================================================================
==54883==ERROR: AddressSanitizer: stack-overflow on address 0x7ffe2411fff8 (pc 0x609d1c707ec3 bp 0x7ffe24120020 sp 0x7ffe24120000 T0)
    #0 0x609d1c707ec3 in match_pattern /workspace/repo/match.c:92
    #1 0x609d1c707ec7 in match_pattern /workspace/repo/match.c:92
    #2 0x609d1c707ec7 in match_pattern /workspace/repo/match.c:92
    #3 0x609d1c707ec7 in match_pattern /workspace/repo/match.c:92
    ...
    #247 0x609d1c707ec7 in match_pattern /workspace/repo/match.c:92
    #248 0x609d1c707ec7 in match_pattern /workspace/repo/match.c:92

SUMMARY: AddressSanitizer: stack-overflow /workspace/repo/match.c:92 in match_pattern
==54883==ABORTING

Reproduction

Generate a CA key and a user key
Issue a user certificate whose principal is a ~400,000-character string
Sign arbitrary data with the certificate so the cert is embedded in the .sig
Create an allowed_signers line of the form '<"*?" x 200000> cert-authority '
Run ssh-keygen -Y find-principals -s data.sig -f allowed_signers, which calls cert_filter_principals -> match_pattern and recurses until the stack is exhausted

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-2NNMB24E.

Reference: ANT-2026-2NNMB24E
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

SECURITY RESEARCH FIRM ANALYSIS

Triage and disclosure were performed by Calif.

Verdict: true positive
Severity: low

TIMELINE

Dates from discovery through public reveal.

2026-03-26 Reported to tracker
2026-05-08 Sent to maintainer
2026-05-09 Maintainer acknowledged
2026-05-30 Patch released
2026-08-17 Publicly revealed

PROVENANCE

SHA-3-512 hash:

116fe51575ccb94d0c8f867a6c2fb617cbf0868bf647baff3ededc9b33b4c0e70698bdbb2d3473a09adbdd86a07545056db8706786efe6e440b53b8cc7ff080e

Committed 2026-05-08 00:10 PT

Revealed 2026-08-17 13:01 PT

Verify (download preimage.json)

Show preimage JSON

{
  "ant_id": "ANT-2026-2NNMB24E",
  "bug_class": "stack-overflow",
  "claude_severity": "critical",
  "commit_sha": "9a50a84f55acd8b7",
  "created_at": "2026-03-27T02:10:14+00:00",
  "description": "OpenSSH's match_pattern() in match.c performs unbounded recursion when handling wildcard patterns. The function is reachable from ssh-keygen -Y find-principals via sshsig_find_principals -> check_allowed_keys_line -> cert_filter_principals, where it matches certificate principals (from the attacker-supplied signature) against principal patterns (from the attacker-supplied allowed_signers file). By supplying a certificate with a ~400,000-character principal and an allowed_signers entry containing ~200,000 repetitions of '*?', an attacker triggers hundreds of thousands of recursive calls and exhausts the stack. The result is a deterministic crash (DoS) of ssh-keygen.",
  "discovered_at": null,
  "location": "match.c:92",
  "poc_sha256": null,
  "preimage_version": 1,
  "project": "openssh",
  "reproduction": [
    "1. Generate a CA key and a user key",
    "2. Issue a user certificate whose principal is a ~400,000-character string",
    "3. Sign arbitrary data with the certificate so the cert is embedded in the .sig",
    "4. Create an allowed_signers line of the form '<\"*?\" x 200000> cert-authority <CA pubkey>'",
    "5. Run ssh-keygen -Y find-principals -s data.sig -f allowed_signers, which calls cert_filter_principals -> match_pattern and recurses until the stack is exhausted"
  ],
  "technical_details": "ASAN: 'stack-overflow on address 0x7ffe2411fff8 ... in match_pattern /workspace/repo/match.c:92'. Each '*' in the pattern causes match_pattern() to recurse while scanning the remaining string; a pattern of the form '*?*?*?...' forces one new recursion level per '*?' pair with no depth cap. When the string is long enough to keep each recursive scan alive, recursion depth is bounded only by pattern length, leading to stack exhaustion.",
  "title": "stack-overflow in openssh",
  "vendor_severity": "low"
}