fail2ban: sshd filter parses the logged username as an address, letting a remote attacker ban arbitrary IPs

Impact

The default sshd filter accepts an "on <token>" suffix after the host address, and OpenSSH logs the offered username verbatim, so an unauthenticated attacker can embed an arbitrary IP address in the username and have fail2ban attribute the failed logins to that address and ban it. On infrastructure where fail2ban guards SSH on bastions, management hosts or GPU node login paths, this turns a defensive daemon into a remote denial-of-service primitive against chosen sources: an attacker can lock out an operator's office range, a jump host, or an automation runner's egress IP at the moment access is most needed. Impact is availability of access only - no code execution and no disclosure. Affected versions are 0.10.5 through 1.1.1 before commit ddd879d, in the default filter mode.

Who can reach it

Anyone who can open an SSH connection to a host monitored by fail2ban and offer a crafted username. No authentication required.

What to do

Update fail2ban past commit ddd879d, or apply the tightened sshd.conf failregex to existing installs, then restart fail2ban on each monitored host and clear any bans created by spoofed entries. A per-host daemon restart; no reboot or drain. Hosts where the sshd jail acts on a shared egress address deserve priority, and allowlisting operator and automation ranges in ignoreip limits the damage either way.

References

Related entries

• OpenSSL QUIC: missing connection-level flow control lets a peer force ~100MB of heap per connectionCVE-2026-75804 · OpenSSL QUIC stack (connection-level flow control)Medium
• OpenSSL CMP client: NULL dereference when revoking a certificate by PKCS#10 CSRCVE-2026-75805 · OpenSSL CMP client (revocation-by-CSR response handling)Medium
• libuser: direct /etc/passwd rewrites can corrupt the account database and chain to local rootCVE-2015-3246 · libuser / usermode userhelper (/etc/passwd modification on RHEL)Medium
• Linux KVM/SVM - missing sev_decommission in sev_receive_start: KVM failed to DECOMMISSION the current SEV contextCVE-2021-47389 · Linux KVM/SVM - missing sev_decommission in sev_receive_startMedium
• QEMU VMDK driver: a crafted image causes an out-of-bounds read leaking 12 bytes or crashing the processCVE-2026-2243 · QEMU VMDK block driver (out-of-bounds read while parsing the image)Medium
• Linux kernel (drivers/iommu/amd): AMD-Vi updated the domain's I/O page-table mode before running the code that freesCVE-2022-48904 · Linux kernel (drivers/iommu/amd)Medium