How many CVEs have a located fix in openssh/openssh-portable?

13 published CVEs have a fix traced to functions in openssh/openssh-portable, touching 6 functions across 15 files.

How large is a typical CVE fix in openssh/openssh-portable?

The median fix changes 15 lines. 54% of fixes change 20 lines or fewer, and 54% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

c

#457 of 500 repositories

openssh/openssh-portable

Name: openssh/openssh-portable: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix April 10, 2025

13

CVE fixes located

Published CVEs

6

Functions patched

Distinct function sites

15

Files patched

Distinct source files

2015–2025

Years covered

By CVE publication date

Overview

13 published CVEs have a fix traced to functions in openssh/openssh-portable, the earliest published in 2015. Those fixes changed 6 distinct functions across 15 files, in 112 patch hunks.

Among the 500 repositories tracked here, openssh/openssh-portable ranks #457 by the number of CVEs with a located fix.

Most patched files

Files in openssh/openssh-portable changed by the most CVE fixes.

1scp.c2 CVEs · 2 functions
2ssh-agent.c2 CVEs · 2 functions
3readconf.h2 CVEs · 1 functions
4sshconnect2.c2 CVEs · 1 functions
5monitor.c2 CVEs · 0 functions
6readconf.c2 CVEs · 0 functions
7auth2-pubkey.c

1 CVEs · 0 functions

8auth-passwd.c1 CVEs · 0 functions

9compat.c1 CVEs · 0 functions

10kex.c1 CVEs · 0 functions

Fix size

How much code a CVE fix in openssh/openssh-portable changes, with backports counted once.

15

Median lines changed

Added plus removed, per CVE

54%

Fixes of 20 lines or fewer

Share of CVE fixes

54%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in openssh/openssh-portable, and the functions each fix changed.

CVE-2025-32728
CVE-2025-32728
Medium · CVSS 4.3
EPSS 0.2%2025-04-10
CVE-2023-51384
CVE-2023-51384dest_constraint_hop sshbuf
Medium · CVSS 5.5
EPSS 0.4%2023-12-18
CVE-2023-51385
CVE-2023-51385
Medium · CVSS 6.5
EPSS 19.8%2023-12-18
CVE-2023-25136
CVE-2023-25136
Medium · CVSS 6.5
EPSS 89.7%2023-02-03
CVE-2021-36368
CVE-2021-36368ForwardOptions cauthctxt
Low · CVSS 3.7
EPSS 1.7%2022-03-12
CVE-2016-20012
CVE-2016-20012ForwardOptions
Medium · CVSS 5.3
EPSS 5.3%2021-09-15
CVE-2021-28041
CVE-2021-28041sshbuf
High · CVSS 7.1
EPSS 3.5%2021-03-05
CVE-2020-12062
CVE-2020-12062stat passwd
High · CVSS 7.5
EPSS 2.2%2020-06-01
CVE-2018-20685
CVE-2018-20685
Medium · CVSS 5.3
EPSS 3.7%2019-01-10
CVE-2016-8858
CVE-2016-8858
High · CVSS 7.5
EPSS 29.5%2016-12-09
CVE-2016-6515
CVE-2016-6515
High · CVSS 7.5
EPSS 58.6%2016-08-07
CVE-2015-6563
CVE-2015-6563
Medium · CVSS 6.4
EPSS 0.4%2015-08-24

Get an alert for each new openssh/openssh-portable CVE, with the patched functions and AI-written analysis.

Monitor openssh-portable CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

apache/kylin13 CVEs apache/superset13 CVEs bagisto/bagisto13 CVEs better-auth/better-auth13 CVEs caddyserver/caddy13 CVEs cerebrate-project/cerebrate13 CVEs CoreWCF/CoreWCF13 CVEs craftcms/commerce13 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in openssh/openssh-portable.

How many CVEs have a located fix in openssh/openssh-portable?: 13 published CVEs have a fix traced to functions in openssh/openssh-portable, touching 6 functions across 15 files.
How large is a typical CVE fix in openssh/openssh-portable?: The median fix changes 15 lines. 54% of fixes change 20 lines or fewer, and 54% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track openssh/openssh-portable CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing