diff --git a/openssh-9.9p1-support-authentication-indicators-in-GSSAPI.patch b/openssh-9.9p1-support-authentication-indicators-in-GSSAPI.patch
index 6c55a66..2a74740 100644
--- a/openssh-9.9p1-support-authentication-indicators-in-GSSAPI.patch
+++ b/openssh-9.9p1-support-authentication-indicators-in-GSSAPI.patch
@@ -10,8 +10,8 @@ diff --color -ruNp a/configure.ac b/configure.ac
  		AC_SEARCH_LIBS([k_hasafs], [kafs], [AC_DEFINE([USE_AFS], [1],
  			[Define this if you want to use libkafs' AFS support])])
 diff --color -ruNp a/gss-serv.c b/gss-serv.c
---- a/gss-serv.c	2026-03-10 12:43:36.802443034 +0100
-+++ b/gss-serv.c	2026-03-12 10:04:37.520993330 +0100
+--- a/gss-serv.c	2026-06-16 15:38:26.590728235 +0200
++++ b/gss-serv.c	2026-06-16 15:41:13.717696103 +0200
 @@ -53,7 +53,7 @@ extern ServerOptions options;
  
  static ssh_gssapi_client gssapi_client =
@@ -21,7 +21,7 @@ diff --color -ruNp a/gss-serv.c b/gss-serv.c
  
  ssh_gssapi_mech gssapi_null_mech =
      { NULL, NULL, {0, NULL}, NULL, NULL, NULL, NULL, NULL};
-@@ -295,6 +295,95 @@ ssh_gssapi_parse_ename(Gssctxt *ctx, gss
+@@ -295,6 +295,99 @@ ssh_gssapi_parse_ename(Gssctxt *ctx, gss
  	return GSS_S_COMPLETE;
  }
  
@@ -44,63 +44,67 @@ diff --color -ruNp a/gss-serv.c b/gss-serv.c
 +	int is_mechname, authenticated, complete, more;
 +	size_t count, i;
 +
++	/* always initialize client->indicators */
++	client->indicators = NULL;
++
 +	ctx->major = gss_inquire_name(&ctx->minor, gss_name,
 +				      &is_mechname, NULL, &attrs);
-+	if (ctx->major != GSS_S_COMPLETE) {
-+		return (ctx->major);
-+	}
++	if (ctx->major != GSS_S_COMPLETE)
++		return ctx->major;
 +
 +	if (attrs == GSS_C_NO_BUFFER_SET) {
-+		/* No indicators in the ticket */
-+		return (0);
++		/* no indicators in the ticket */
++		return GSS_S_COMPLETE;
 +	}
 +
-+	client->indicators = NULL;
++	/* client->indicators is NULL terminated */
 +	count = 0;
++	client->indicators = xcalloc(count + 1, sizeof(char *));
++
 +	for (i = 0; i < attrs->count; i++) {
 +		authenticated = 0;
 +		complete = 0;
 +		more = -1;
++
 +		/* skip anything but auth-indicators */
 +		if (((sizeof(AUTH_INDICATORS_TAG) - 1) != attrs->elements[i].length) ||
-+		    memcmp(AUTH_INDICATORS_TAG,
-+			   attrs->elements[i].value,
++		    memcmp(AUTH_INDICATORS_TAG, attrs->elements[i].value,
 +			   sizeof(AUTH_INDICATORS_TAG) - 1) != 0)
 +			continue;
++
 +		/* retrieve all indicators */
 +		while (more != 0) {
 +			value.value = NULL;
 +			display_value.value = NULL;
++
 +			ctx->major = gss_get_name_attribute(&ctx->minor, gss_name,
-+							    &attrs->elements[i], &authenticated,
-+							    &complete, &value, &display_value, &more);
++							    &attrs->elements[i],
++							    &authenticated, &complete,
++							    &value, &display_value, &more);
 +			if (ctx->major != GSS_S_COMPLETE)
 +				goto out;
 +
-+			if ((value.value != NULL) && authenticated) {
-+				if (count >= SSH_GSSAPI_MAX_INDICATORS) {
-+					logit("ssh_gssapi_getindicators: too many "
-+					    "indicators, truncating at %d",
-+					    SSH_GSSAPI_MAX_INDICATORS);
-+					/* value/display_value released at out: */
-+					goto done;
-+				}
++			if (value.value == NULL || !authenticated)
++				continue;
 +
-+				client->indicators = xrecallocarray(client->indicators, count, count + 1, sizeof(char*));
-+				if (client->indicators == NULL) {
-+					fatal("ssh_gssapi_getindicators failed to allocate memory");
-+				}
-+				client->indicators[count] = xmalloc(value.length + 1);
-+				memcpy(client->indicators[count], value.value, value.length);
-+				client->indicators[count][value.length] = '\0';
-+				count++;
++			if (count >= SSH_GSSAPI_MAX_INDICATORS) {
++				logit("ssh_gssapi_getindicators:"
++				      " too many indicators, truncating at %d",
++				      SSH_GSSAPI_MAX_INDICATORS);
++				goto out;
 +			}
++
++			client->indicators[count] = xmalloc(value.length + 1);
++			memcpy(client->indicators[count], value.value, value.length);
++			client->indicators[count][value.length] = '\0';
++			count++;
++
++			/* add NULL terminator */
++			client->indicators = xrecallocarray(client->indicators, count,
++							    count + 1, sizeof(char *));
 +		}
 +	}
 +
-+done:
-+	/* slot [count] is zeroed by recallocarray, serves as NULL sentinel */
-+
 +out:
 +	if (ctx->major != GSS_S_COMPLETE && client->indicators != NULL) {
 +		for (i = 0; i < count; i++)
@@ -108,16 +112,16 @@ diff --color -ruNp a/gss-serv.c b/gss-serv.c
 +		free(client->indicators);
 +		client->indicators = NULL;
 +	}
-+	(void) gss_release_buffer(&ctx->minor, &value);
-+	(void) gss_release_buffer(&ctx->minor, &display_value);
-+	(void) gss_release_buffer_set(&ctx->minor, &attrs);
-+	return (ctx->major);
++	gss_release_buffer(&ctx->minor, &value);
++	gss_release_buffer(&ctx->minor, &display_value);
++	gss_release_buffer_set(&ctx->minor, &attrs);
++	return ctx->major;
 +}
 +
  /* Extract the client details from a given context. This can only reliably
   * be called once for a context */
  
-@@ -384,6 +473,12 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_g
+@@ -384,6 +477,12 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_g
  	}
  
  	gss_release_buffer(&ctx->minor, &ename);
@@ -130,7 +134,7 @@ diff --color -ruNp a/gss-serv.c b/gss-serv.c
  
  	/* We can't copy this structure, so we just move the pointer to it */
  	client->creds = ctx->client_creds;
-@@ -446,6 +541,7 @@ int
+@@ -446,6 +545,7 @@ int
  ssh_gssapi_userok(char *user, struct passwd *pw, int kex)
  {
  	OM_uint32 lmin;
@@ -138,7 +142,7 @@ diff --color -ruNp a/gss-serv.c b/gss-serv.c
  
  	(void) kex; /* used in privilege separation */
  
-@@ -464,8 +560,14 @@ ssh_gssapi_userok(char *user, struct pas
+@@ -464,8 +564,14 @@ ssh_gssapi_userok(char *user, struct pas
  			gss_release_buffer(&lmin, &gssapi_client.displayname);
  			gss_release_buffer(&lmin, &gssapi_client.exportedname);
  			gss_release_cred(&lmin, &gssapi_client.creds);
diff --git a/openssh.spec b/openssh.spec
index 72699f6..3dc41bd 100644
--- a/openssh.spec
+++ b/openssh.spec
@@ -744,6 +744,9 @@ test -f %{sysconfig_anaconda} && \
 - CVE-2026-55653: Fix double free in openssh DH-GEX client path during
   FIPS known-group validation that leads to client-side denial of service
   Resolves: RHEL-185776
+- CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator
+  cleanup due to missing NULL terminator
+  Resolves: RHEL-185831
 
 * Tue Apr 14 2026 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-26
 - Improve keytab detection when obtaining Kerberos tickets on behalf of user on SSH authentication