diff --git a/openssh-10.4p1-CVE-2026-59999.patch b/openssh-10.4p1-CVE-2026-59999.patch
index 67b203e..b1bf58c 100644
--- a/openssh-10.4p1-CVE-2026-59999.patch
+++ b/openssh-10.4p1-CVE-2026-59999.patch
@@ -1,5 +1,69 @@
+diff --git a/auth-options.c b/auth-options.c
+index e15f600ab..c5fc4e59c 100644
+--- a/auth-options.c
++++ b/auth-options.c
+@@ -242,6 +242,7 @@ sshauthopt_new_with_keys_defaults(void)
+ 	ret->permit_x11_forwarding_flag = 1;
+ 	ret->permit_pty_flag = 1;
+ 	ret->permit_user_rc = 1;
++	ret->permit_tun_flag = 1;
+ 	return ret;
+ }
+
+@@ -345,6 +346,7 @@ sshauthopt_parse(const char *opts, const char **errstrp)
+ 			ret->permit_x11_forwarding_flag = 0;
+ 			ret->permit_pty_flag = 0;
+ 			ret->permit_user_rc = 0;
++			ret->permit_tun_flag = 0;
+ 		} else if ((r = opt_flag("cert-authority", 0, &opts)) != -1) {
+ 			ret->cert_authority = r;
+ 		} else if ((r = opt_flag("port-forwarding", 1, &opts)) != -1) {
+@@ -601,6 +603,7 @@ sshauthopt_merge(const struct sshauthopt *primary,
+ 	OPTFLAG_AND(permit_x11_forwarding_flag);
+ 	OPTFLAG_AND(permit_pty_flag);
+ 	OPTFLAG_AND(permit_user_rc);
++	OPTFLAG_AND(permit_tun_flag);
+ 	OPTFLAG_AND(no_require_user_presence);
+ 	/* Restrictive flags are logical-OR (i.e. must be set in either) */
+ 	OPTFLAG_OR(require_verify);
+@@ -669,6 +672,7 @@ sshauthopt_copy(const struct sshauthopt *orig)
+ 	OPTSCALAR(permit_x11_forwarding_flag);
+ 	OPTSCALAR(permit_pty_flag);
+ 	OPTSCALAR(permit_user_rc);
++	OPTSCALAR(permit_tun_flag);
+ 	OPTSCALAR(restricted);
+ 	OPTSCALAR(cert_authority);
+ 	OPTSCALAR(force_tun_device);
+@@ -804,6 +808,7 @@ sshauthopt_serialise(const struct sshauthopt *opts, struct sshbuf *m,
+ 	    (r = sshbuf_put_u8(m, opts->permit_x11_forwarding_flag)) != 0 ||
+ 	    (r = sshbuf_put_u8(m, opts->permit_pty_flag)) != 0 ||
+ 	    (r = sshbuf_put_u8(m, opts->permit_user_rc)) != 0 ||
++	    (r = sshbuf_put_u8(m, opts->permit_tun_flag)) != 0 ||
+ 	    (r = sshbuf_put_u8(m, opts->restricted)) != 0 ||
+ 	    (r = sshbuf_put_u8(m, opts->cert_authority)) != 0 ||
+ 	    (r = sshbuf_put_u8(m, opts->no_require_user_presence)) != 0 ||
+@@ -867,6 +872,7 @@ sshauthopt_deserialise(struct sshbuf *m, struct sshauthopt **optsp)
+ 	OPT_FLAG(permit_x11_forwarding_flag);
+ 	OPT_FLAG(permit_pty_flag);
+ 	OPT_FLAG(permit_user_rc);
++	OPT_FLAG(permit_tun_flag);
+ 	OPT_FLAG(restricted);
+ 	OPT_FLAG(cert_authority);
+ 	OPT_FLAG(no_require_user_presence);
+diff --git a/auth-options.h b/auth-options.h
+index 6e29b727c..191b9b249 100644
+--- a/auth-options.h
++++ b/auth-options.h
+@@ -39,6 +39,7 @@ struct sshauthopt {
+ 	int permit_x11_forwarding_flag;
+ 	int permit_pty_flag;
+ 	int permit_user_rc;
++	int permit_tun_flag;
+
+ 	/* "restrict" keyword was invoked */
+ 	int restricted;
 diff --git a/serverloop.c b/serverloop.c
-index 8a6e3db80..9d8a3429e 100644
+index 8a6e3db80..cf5243f80 100644
 --- a/serverloop.c
 +++ b/serverloop.c
 @@ -523,7 +523,8 @@ server_request_tun(struct ssh *ssh)
@@ -8,7 +72,7 @@ index 8a6e3db80..9d8a3429e 100644
  	}
 -	if ((options.permit_tun & mode) == 0) {
 +	if ((options.permit_tun & mode) == 0 || options.disable_forwarding ||
-+	    auth_opts->restricted) {
++	    !auth_opts->permit_tun_flag) {
  		ssh_packet_send_debug(ssh, "Server has rejected tunnel device "
  		    "forwarding");
  		return NULL;
diff --git a/openssh-10.5p1-CVE-2026-73281.patch b/openssh-10.5p1-CVE-2026-73281.patch
new file mode 100644
index 0000000..b59ec35
--- /dev/null
+++ b/openssh-10.5p1-CVE-2026-73281.patch
@@ -0,0 +1,42 @@
+diff --git a/ssh-agent.c b/ssh-agent.c
+--- a/ssh-agent.c
++++ b/ssh-agent.c
+@@ -1839,8 +1839,17 @@ process_extension(SocketEntry *e)
+ 		error_fr(r, "parse");
+ 		goto send;
+ 	}
++
++	/*
++	 * This function can be called while the agent is locked to allow
++	 * session binds to be processed for new channels.
++	 * Other operations should be refused when locked.
++	 */
++
+ 	if (strcmp(name, "session-bind@openssh.com") == 0)
+ 		success = process_ext_session_bind(e);
++	else if (locked)
++		debug_f("attempt to use extension \"%s\" while locked", name);
+ 	else
+ 		debug_f("unsupported extension \"%s\"", name);
+ 	free(name);
+@@ -1892,16 +1901,19 @@ process_message(u_int socknum)
+
+ 	/* check whether agent is locked */
+ 	if (locked && type != SSH_AGENTC_UNLOCK) {
+-		sshbuf_reset(e->request);
+ 		switch (type) {
+ 		case SSH2_AGENTC_REQUEST_IDENTITIES:
+ 			/* send empty lists */
+ 			no_identities(e);
+ 			break;
++		case SSH_AGENTC_EXTENSION:
++			process_extension(e);
++			break;
+ 		default:
+ 			/* send a fail message for all other request types */
+ 			send_status(e, 0);
+ 		}
++		sshbuf_reset(e->request);
+ 		return 1;
+ 	}
+
diff --git a/openssh-10.5p1-CVE-2026-73282.patch b/openssh-10.5p1-CVE-2026-73282.patch
new file mode 100644
index 0000000..a4c4973
--- /dev/null
+++ b/openssh-10.5p1-CVE-2026-73282.patch
@@ -0,0 +1,51 @@
+diff --git a/ssh.c b/ssh.c
+--- a/ssh.c
++++ b/ssh.c
+@@ -1862,14 +1862,24 @@
+ 	}
+ }
+ 
++struct rfwd_confirm_ctx {
++	int fid;
++};
++
+ /* Callback for remote forward global requests */
+ static void
+ ssh_confirm_remote_forward(struct ssh *ssh, int type, u_int32_t seq, void *ctxt)
+ {
+-	struct Forward *rfwd = (struct Forward *)ctxt;
++	struct rfwd_confirm_ctx *rctx = (struct rfwd_confirm_ctx *)ctxt;
++	struct Forward *rfwd;
+ 	u_int port;
+ 	int r;
+ 
++	if (rctx->fid < 0 || rctx->fid >= options.num_remote_forwards)
++		fatal_f("invalid forwarding ID %d", rctx->fid);
++	rfwd = &options.remote_forwards[rctx->fid];
++	freezero(rctx, sizeof(*rctx));
++
+ 	/* XXX verbose() on failure? */
+ 	debug("remote forward %s for: listen %s%s%d, connect %s:%d",
+ 	    type == SSH2_MSG_REQUEST_SUCCESS ? "success" : "failure",
+@@ -2047,6 +2057,8 @@
+ 
+ 	/* Initiate remote TCP/IP port forwardings. */
+ 	for (i = 0; i < options.num_remote_forwards; i++) {
++		struct rfwd_confirm_ctx *rctx;
++
+ 		debug("Remote connections from %.200s:%d forwarded to "
+ 		    "local address %.200s:%d",
+ 		    (options.remote_forwards[i].listen_path != NULL) ?
+@@ -2061,9 +2073,10 @@
+ 		if ((options.remote_forwards[i].handle =
+ 		    channel_request_remote_forwarding(ssh,
+ 		    &options.remote_forwards[i])) >= 0) {
++			rctx = xcalloc(1, sizeof(*rctx));
++			rctx->fid = i;
+ 			client_register_global_confirm(
+-			    ssh_confirm_remote_forward,
+-			    &options.remote_forwards[i]);
++			    ssh_confirm_remote_forward, rctx);
+ 			forward_confirms_pending++;
+ 		} else if (options.exit_on_forward_failure)
+ 			fatal("Could not request remote forwarding.");
diff --git a/openssh.spec b/openssh.spec
index c430156..99cdea9 100644
--- a/openssh.spec
+++ b/openssh.spec
@@ -43,7 +43,7 @@
 Summary: An open source implementation of SSH protocol version 2
 Name: openssh
 Version: %{openssh_ver}
-Release: 29%{?dist}.alma.1
+Release: 30%{?dist}.alma.1
 URL: http://www.openssh.com/portable.html
 Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
 Source1: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz.asc
@@ -264,7 +264,12 @@ Patch1048: openssh-10.4p1-CVE-2026-59995.patch
 # upstream 8dfe7ed6e2fd988de08df508355a196b956b2753
 # upstream d322f2ccf7da095ce94d1d99cb563246f61487b0
 # combines CVE-2026-59999 and CVE-2026-73283
+# downstream specific fix, drop on rebase
 Patch1049: openssh-10.4p1-CVE-2026-59999.patch
+# upstream 6a57081dc35acf3ee298108d4bc3580489608d5f
+Patch1050: openssh-10.5p1-CVE-2026-73281.patch
+# upstream 9910d5ef53124ce1157d57bc11e222658aa41299
+Patch1051: openssh-10.5p1-CVE-2026-73282.patch
 
 License: BSD-3-Clause AND BSD-2-Clause AND ISC AND SSH-OpenSSH AND ssh-keyscan AND snprintf AND LicenseRef-Fedora-Public-Domain AND X11-distribute-modifications-variant
 Requires: /sbin/nologin
@@ -478,6 +483,8 @@ gpgv2 --quiet --keyring %{SOURCE3} %{SOURCE1} %{SOURCE0}
 %patch -P 1047 -p1 -b .copy-data-ext-self-copy
 %patch -P 1048 -p1 -b .CVE-2026-59995
 %patch -P 1049 -p1 -b .CVE-2026-59999
+%patch -P 1050 -p1 -b .CVE-2026-73281
+%patch -P 1051 -p1 -b .CVE-2026-73282
 
 %patch -P 100 -p1 -b .coverity
 
@@ -758,9 +765,20 @@ test -f %{sysconfig_anaconda} && \
 %attr(0755,root,root) %{_libdir}/sshtest/sk-dummy.so
 
 %changelog
-* Fri Aug 14 2026 Koichiro Iwao <meta@almalinux.org> - 9.9p1-29.alma.1
+* Tue Aug 25 2026 Koichiro Iwao <meta@almalinux.org> - 9.9p1-30.alma.1
 - Unpatch Red Hat help message
 
+* Fri Aug 21 2026 Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-30
+- CVE-2026-73283: Complete the fix of security bypass due to incorrect
+  handling of forwarding and tunneling options
+  Resolves: RHEL-242759
+- CVE-2026-73281: Fix misinteraction between agent locking and
+  the session-bind@openssh.com extension
+  Resolves: RHEL-245421
+- CVE-2026-73282: Fix information disclosure and data corruption
+  via use-after-free in ssh client
+  Resolves: RHEL-245417
+
 * Wed Aug 12 2026 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-29
 - Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded
   file location