How severe is CVE-2016-3115?

CVE-2016-3115 has a CVSS 3.x base score of 6.4, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2016-3115 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 37% (98th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2016-3115?

CVE-2016-3115 primarily affects Openbsd Openssh. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2016-3115?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2016-3115 published?

CVE-2016-3115 was published on 2016-03-22 and last updated on 2026-06-17.

CVE-2016-3115

CVE-2016-3115 is a medium-severity vulnerability in Openbsd Openssh with a CVSS 3.x base score of 6.4. Its EPSS exploit-prediction score of 37% places it in the 98th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-93.

Key facts

Severity: Medium (CVSS 3.x base score 6.4)
CVSS v2: 5.5
EPSS exploit prediction: 37% (98th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-93
Affected product: Openbsd Openssh
Published: 2016-03-22
Last modified: 2026-06-17

Description

Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the (1) do_authenticated1 and (2) session_x11_req functions.

Frequently asked questions

What is CVE-2016-3115?: Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the (1) do_authenticated1 and (2) session_x11_req functions.
How severe is CVE-2016-3115?: CVE-2016-3115 has a CVSS 3.x base score of 6.4, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2016-3115 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 37% (98th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2016-3115?: CVE-2016-3115 primarily affects Openbsd Openssh. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2016-3115?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2016-3115 published?: CVE-2016-3115 was published on 2016-03-22 and last updated on 2026-06-17.

References

Affected products (2)

cpe:2.3:a:openbsd:openssh:*:p1:*:*:*:*:*:*
cpe:2.3:o:oracle:vm_server:3.2:*:*:*:*:*:*:*

More vulnerabilities in Openbsd Openssh

CVE-2003-0786 — Critical (CVSS 10.0): The SSH1 PAM challenge response authentication in OpenSSH 3.7.1 and 3.7.1p1, when Privilege Separation is disabled,…
CVE-2003-0693 — Critical (CVSS 10.0): A "buffer management error" in buffer_append_space of buffer.c for OpenSSH before 3.7 may allow remote attackers to…
CVE-2002-0640 — Critical (CVSS 10.0): Buffer overflow in sshd in OpenSSH 2.3.1 through 3.3 may allow remote attackers to execute arbitrary code via a large…
CVE-2001-0144 — Critical (CVSS 10.0): CORE SDI SSH1 CRC-32 compensation attack detector allows remote attackers to execute arbitrary commands on an SSH…
CVE-2000-0999 — Critical (CVSS 10.0): Format string vulnerabilities in OpenBSD ssh program (and possibly other BSD-based operating systems) allow attackers…
CVE-2000-0525 — Critical (CVSS 10.0): OpenSSH does not properly drop privileges when the UseLogin option is enabled, which allows local users to execute…

All CVEs affecting Openbsd Openssh →

Other CWE-93 (CRLF Injection) vulnerabilities

CVE-2024-51501 — Critical (CVSS 10.0): Refit is an automatic type-safe REST library for .NET Core, Xamarin and .NET The various header-related Refit…
CVE-2026-45372 — Critical (CVSS 9.9): cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, when cpp-httplib's…
CVE-2026-11362 — Critical (CVSS 9.8): DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags. DataDog::DogStatsd does not…
CVE-2025-40671 — Critical (CVSS 9.3): SQL injection vulnerability in AES Multimedia's Gestnet v1.07. This vulnerability allows an attacker to retrieve,…
CVE-2026-11373 — Critical (CVSS 9.1): Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections. Net::Statsite::Client is a client for…
CVE-2026-50638 — Critical (CVSS 9.1): Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injections. The statsd…

Browse all CWE-93 (CRLF Injection) vulnerabilities →

Threat intelligence

Threat-intel indicators referencing this CVE:

122.114.69.235 (ipv4-addr)
92.47.46.174 (ipv4-addr)
76.12.128.249 (ipv4-addr)
64.53.7.231 (ipv4-addr)
62.182.118.138 (ipv4-addr)
61.76.136.25 (ipv4-addr)
213.135.175.76 (ipv4-addr)
187.237.47.214 (ipv4-addr)