- CVE-2026-106555: sshd kept GSSAPI client state from a partially completed authentication attempt and could reuse it in a later attempt; reset it before each attempt. Backport upstream commits 670510d1 and d549f99d. - CVE-2026-106553: sshd stored delegated GSSAPI credentials even when GSSAPI user authorization had not succeeded; store them only after it succeeds. Backport upstream commit 6f9cd19a. - CVE-2026-106583: ssh(1) accepted '$' and '\' in a command-line user name, allowing injection via shell-expanded commands; reject both characters. Backport upstream commit 0c4c9a7b. - CVE-2026-106585: a compressed packet could inflate far beyond the maximum packet size and exhaust memory; reject it once the decompressed payload reaches PACKET_MAX_SIZE. Backport upstream commit e0f85d83.