diff --git a/SOURCES/openssh-7.2p2-x11.patch b/SOURCES/openssh-7.2p2-x11.patch
index 48ce840..b5ca9c1 100644
--- a/SOURCES/openssh-7.2p2-x11.patch
+++ b/SOURCES/openssh-7.2p2-x11.patch
@@ -30,7 +30,7 @@ diff -up openssh-7.2p2/channels.c.x11 openssh-7.2p2/channels.c
  	return -1;
  }
  
-@@ -4012,8 +4015,18 @@ static int
+@@ -4668,8 +4671,19 @@ static int
  connect_local_xsocket(u_int dnr)
  {
  	char buf[1024];
@@ -39,10 +39,11 @@ diff -up openssh-7.2p2/channels.c.x11 openssh-7.2p2/channels.c
 +	int len, ret;
 +	len = snprintf(buf + 1, sizeof (buf) - 1, _PATH_UNIX_X, dnr);
 +#ifdef linux
-+	/* try abstract socket first */
-+	buf[0] = '\0';
-+	if ((ret = connect_local_xsocket_path(buf, len + 1)) >= 0)
-+		return ret;
++	if (getenv("SSH_INSECURE_ABSTRACT_SOCKET_ENABLED") != NULL) {
++		buf[0] = '\0';
++		if ((ret = connect_local_xsocket_path(buf, len + 1)) >= 0)
++			return ret;
++	}
 +#endif
 +	if ((ret = connect_local_xsocket_path(buf + 1, len)) >= 0)
 +		return ret;
diff --git a/SOURCES/openssh-7.7p1-fips.patch b/SOURCES/openssh-7.7p1-fips.patch
index 0cbd22f..3a80074 100644
--- a/SOURCES/openssh-7.7p1-fips.patch
+++ b/SOURCES/openssh-7.7p1-fips.patch
@@ -116,17 +116,18 @@ diff -up openssh-7.9p1/kexgexc.c.fips openssh-7.9p1/kexgexc.c
  #include <sys/types.h>
  
  #include <openssl/dh.h>
-@@ -118,6 +119,10 @@ input_kex_dh_gex_group(int type, u_int32
- 		r = SSH_ERR_ALLOC_FAIL;
- 		goto out;
+@@ -115,6 +116,11 @@ input_kex_dh_gex_group(int type, u_int32
  	}
+ 	p = g = NULL; /* belong to kex->dh now */
+ 
 +	if (FIPS_mode() && dh_is_known_group(kex->dh) == 0) {
 +		r = SSH_ERR_INVALID_ARGUMENT;
 +		goto out;
 +	}
- 	p = g = NULL; /* belong to kex->dh now */
- 
++
  	/* generate and send 'e', client DH public key */
+ 	if ((r = dh_gen_key(kex->dh, kex->we_need * 8)) != 0)
+ 		goto out;
 diff -up openssh-7.9p1/myproposal.h.fips openssh-7.9p1/myproposal.h
 --- openssh-7.9p1/myproposal.h.fips	2018-10-17 02:01:20.000000000 +0200
 +++ openssh-7.9p1/myproposal.h	2019-03-11 17:06:37.621878041 +0100
diff --git a/SPECS/openssh.spec b/SPECS/openssh.spec
index 4441f58..2b7a678 100644
--- a/SPECS/openssh.spec
+++ b/SPECS/openssh.spec
@@ -66,7 +66,7 @@
 
 # Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1
 %global openssh_ver 8.0p1
-%global openssh_rel 29
+%global openssh_rel 30
 %global pam_ssh_agent_ver 0.10.3
 %global pam_ssh_agent_rel 7
 
@@ -854,6 +854,14 @@ getent passwd sshd >/dev/null || \
 %endif
 
 %changelog
+* Mon Jun 29 2026 Zoltan Fridrich <zfridric@redhat.com> - 8.0p1-30
+- CVE-2026-55653: Fix double free in openssh DH-GEX client path during
+  FIPS known-group validation that leads to client-side denial of service
+  Resolves: RHEL-185775
+- CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket
+  pre-binding
+  Resolves: RHEL-185855
+
 * Mon Apr 13 2026 Zoltan Fridrich <zfridric@redhat.com> - 8.0p1-29
 - CVE-2026-35385: Fix privilege escalation via scp legacy protocol
   when not in preserving file mode