Download tarballs from
https://matt.ucc.asn.au/dropbear/releases/dropbear-2026.92.tar.bz2 or
https://dropbear.nl/mirror/releases/dropbear-2026.92.tar.bz2
The tarball is reproducible from git with release.sh
Note >> for compatibility/configuration changes
-
Security: Fix a use-after-free in X11 forwarding that could possibly lead
to memory corruption. This is vulnerable to authenticated users if X11
forwarding is enabled. By default X11 forwarding is not built.
In 2026.89 the server is running as the authenticated user for X11
forwarding, in earlier versions it runs as root.
This removes X11 "single connection" which has probably never been used.
Reported by @peter-pe
882f838 -
>> "permitlisten" authorized_keys lines will now be ignored if
the port is invalid (>65536). From Basavaraj S Maneppagol. -
>> In 2026.92, the configure option --enable-plugin-deprecated
wasn't correctly renamed. This is now implemented.
Patch from Alexander Dahl -
Two factor auth "-t" is no longer deprecated, it will be kept.
The "DEPRECATED_TWO_FACTOR" option is ignored, and no longer required. -
Fix out of bounds read during utmp/wtmp log file handling, reported by
Basavaraj S Maneppagol. -
More robust handling of ascii inputs for some platforms.
From Basavaraj S Maneppagol -
Convert manpages to mdoc format, from shrub
