This is a preview-release (non-production ready)

This release includes:

• Upstream changes from OpenSSH 10.0p2
• Fix #2391: add support for mlkem768x25519-sha256 and sntrup761x25519-sha512
• Fix #2394: ssh-keygen resident key generation error message
• PowerShell/openssh-portable#795: fix null pointer reference in sigaction - thanks @James-ZHANG!
• PowerShell/openssh-portable#808: update MSI and install-sshd.ps1 with RedirectionGuard for ssh-agent and sshd
• Fix #2361: bug in FixHostFilePermissions.ps1
• PowerShell/openssh-portable#777: migrate all dependency ingestion to VCPkg
• Upgrade to LibFido2 1.16.0. Please refer to https://developers.yubico.com/libfido2/Release_Notes.html
• Upgrade to LibreSSL 4.2.0. Please refer to https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.2.0-relnotes.txt

This is a preview-release (non-production ready)

This release includes:

• fix for #2346, otherwise equivalent to the v9.8.2.0p2-Preview release.

This is a preview-release (non-production ready)

This release includes:

• Security Fixes:
  • [ssh-agent]: fix CVE-2025-27731, thanks for reporting @jborean93!
  • [ssh]: fix CVE-2025-26465 cherry-picked from upstream, see OpenSSH 9.9p2 for more information.
  • [sshd]: fix CVE-2025-26466 cherry-picked from upstream, see OpenSSH 9.9p2 for more information.
• Non-Security Fixes:
  • fix #2316 (PowerShell/openssh-portable#759) - thanks @manu0401!
  • [sftp]: fix #2288 (PowerShell/openssh-portable#765).
  • [sftp]: fix #2295 (PowerShell/openssh-portable#762).
  • [ssh]: fix #2309 (PowerShell/openssh-portable#768).
  • [ssh-agent]: fix #2286 (PowerShell/openssh-portable#757).
  • [ssh-keygen]: fix #2298 (PowerShell/openssh-portable#764).
  • [ssh-keyscan]: fix #2140 (PowerShell/openssh-portable#756).
  • [sshd]: fix #2233 (PowerShell/openssh-portable#738).
  • [sshd]: fix #2282 (PowerShell/openssh-portable#761).
  • [sshd]: fix #2296 (PowerShell/openssh-portable#775).
  • [sshd]: fix #2312 (PowerShell/openssh-portable#770).
  • [sshd]: fix #2315 (PowerShell/openssh-portable#769).
  • upgrade to LibreSSL 4.0.0. Please refer to https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.0.0-relnotes.txt.

This is a preview-release (non-production ready)

This release includes:

• fix for MSI, otherwise equivalent to the v9.8.0.0p1-Preview release.

This is a preview-release (non-production ready)

Note that the change from "beta" to "preview" is simply to align with release naming requirements.

This release includes:

• Upstream changes from OpenSSH 9.8p1.

• Security Fixes (all pertaining to Windows parity with pre-existing upstream behavior):

  • [ssh-agent] validate a PKCS11 library path based on allow-list configurable via -P, with default allow-list set to $env:ProgramFiles and $env:ProgramFiles(x86) - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38029.
  • [sftp] check for invalid character in filename to prevent recursive directory attack - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43581.
  • [scp] check for invalid character in filename to prevent recursive directory attack - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43615.

• Non-Security Fixes:

  • Upgrade to ZLib 1.3.1. Please refer to https://zlib.net/.
  • Upgrade to LibreSSL 3.9.2. Please refer to https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.9.2-relnotes.txt.
  • Upgrade to LibFido2 1.15.0. Please refer to https://developers.yubico.com/libfido2/Release_Notes.html.

This is a beta-release (non-production ready)

This release includes:

• Upstream changes from OpenSSH 9.5p1 and a cherry-pick of the "strict KEX" protocol extension changes from OpenSSH 9.6p1.

• Breaking Changes:

  • Remove sha1-based MACs from default configuration options in https://github.com/PowerShell/openssh-portable/pull/706/files.

• Security Fixes:

  • Service paths for SSHD and SSH-Agent in contrib\win32\openssh\install-sshd.ps1 are encapsulated in double-quotes.

• Non-Security Fixes:

  • [SCP/SFTP] Permit data upload that originates from a named pipe in PowerShell/openssh-portable#704.
  • Upgrade to LibreSSL 3.8.2. Please refer to https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.8.2-relnotes.txt.
  • Upgrade to LibFido2 1.14.0. Please refer to https://developers.yubico.com/libfido2/Release_Notes.html.

This is a beta-release (non-production ready)

This release includes:

• Upstream changes from OpenSSH 9.3p2 and OpenSSH 9.4.

• Breaking changes - see upstream release notes for more information:

  • the ssh-agent will now refuse requests to load PKCS#11 modules issued by remote clients by default. A flag has been added to restore the previous behavior "-Oallow-remote-pkcs11".

• Security Fixes:

  • the sshd service will check the $env:ProgramData\ssh folder permissions upon startup to ensure only SYSTEM and Administrator accounts have write access to the folder; similar to the existing check upon install in contrib\win32\openssh\install-sshd.ps1.

• Non-Security Fixes:

  • Upgrade to LibreSSL 3.7.3. Please refer to https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.7.3-relnotes.txt
  • Upgrade to ZLib 1.3. Please refer to http://zlib.net/
  • Fix #2125 - thanks @samhocevar!
  • Fix datatype mismatch - thanks @s911415!

This is a beta-release (non-production ready)

This release includes:

• Security Fixes:

  • Upgrade to LibreSSL 3.7.2. Please refer to https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.7.2-relnotes.txt
  • MSI: change inbound firewall rule that opens port 22 to apply to Private networks only

• Non-Security Fixes:

  • Add U2F/Fido2 keys to the agent from other clients: #1961 - thanks @ddrown!
  • Fix output codepage after executing scp/sftp/ssh/ssh-keygen command: #2027 - thanks @kemaruya!
  • Fix early EOF termination when running git fetch over ssh: #2012 - thanks @cwgreene!
  • Revert mark-of-the-web for SCP/SFTP file downloads: #2029

This is a beta-release (non-production ready)

This release includes:

• Upstream changes from OpenSSH 9.2, which fixes a number of security bugs.

• Breaking changes - see upstream release notes for more information:

  • adds EnableEscapeCommandline to ssh_config, a new option, that controls whether the client-side ~C escape sequence that provides a command-line is available. EnableEscapeCommandline defaults to "no", which disables the ~C escape sequence that was previously enabled by default.

• Security:

  • The sftp server will not attempt to add the Mark-of-the-Web (MOTW) for files uploaded from sftp clients, which reverts the behavior added in 9.1. This is on par with scp behavior for file uploads. File download behavior via scp and sftp remains the same as 9.1, with a best effort attempt to add the MOTW. This change was prompted by Community feedback, as discussed in #2029.

• Fixes for #2018 and #2019.

This is a beta-release (non-production ready)

This release includes:

• Upstream changes from OpenSSH 9.0 & OpenSSH 9.1.

• Breaking changes - see upstream release notes for more information:

  • Switches scp from using the legacy scp/rcp protocol to using the sftp protocol by default.
  • SetEnv directives in ssh_config and sshd_config are now first-match-wins to match other directives. Previously if an environment variable was multiply specified the last set value would have been used.
  • ssh-keygen -A (generate all default host key types) will no longer generate DSA keys.

• Security Fixes:

  • adds Mark of the Web (MOTW) to scp/sftp file transfers, when possible.

• Fixes for various reliability issues listed here.

• LibFido2 upgrade to version 1.12.0.

• LibreSSL upgrade to version 3.6.1.

• ZLib upgrade to version 1.2.13.