diff --git a/SOURCES/openssh-6.7p1-coverity.patch b/SOURCES/openssh-6.7p1-coverity.patch
index ffe0c69..33dbb20 100644
--- a/SOURCES/openssh-6.7p1-coverity.patch
+++ b/SOURCES/openssh-6.7p1-coverity.patch
@@ -159,7 +159,47 @@ diff -up openssh-8.7p1/openbsd-compat/bsd-pselect.c.coverity openssh-8.7p1/openb
 diff -up openssh-8.5p1/readconf.c.coverity openssh-8.5p1/readconf.c
 --- openssh-8.5p1/readconf.c.coverity	2021-03-24 12:03:33.778968131 +0100
 +++ openssh-8.5p1/readconf.c	2021-03-24 12:03:33.785968180 +0100
-@@ -1847,6 +1847,7 @@ parse_pubkey_algos:
+@@ -749,12 +749,12 @@ match_cfg_line(Options *options, const c
+ 	debug2("checking match for '%s' host %s originally %s",
+ 	    full_line, host, original_host);
+ 	while ((attrib = argv_next(acp, avp)) != NULL) {
+-		attrib = oattrib = xstrdup(attrib);
+ 		/* Terminate on comment */
+ 		if (*attrib == '#') {
+ 			argv_consume(acp);
+ 			break;
+ 		}
++		attrib = oattrib = xstrdup(attrib);
+ 		arg = criteria = NULL;
+ 		this_result = 1;
+ 		if ((negate = (attrib[0] == '!')))
+@@ -793,7 +793,7 @@ match_cfg_line(Options *options, const c
+ 			debug3("%.200s line %d: %smatched '%s'",
+ 			    filename, linenum,
+ 			    this_result ? "" : "not ", oattrib);
+-			continue;
++			goto next;
+ 		}
+ 
+ 		/* Keep this list in sync with below */
+@@ -863,7 +863,7 @@ match_cfg_line(Options *options, const c
+ 				debug3("%.200s line %d: skipped exec "
+ 				    "\"%.100s\"", filename, linenum, cmd);
+ 				free(cmd);
+-				continue;
++				goto next;
+ 			}
+ 			r = execute_in_shell(cmd);
+ 			if (r == -1) {
+@@ -887,6 +887,7 @@ match_cfg_line(Options *options, const c
+ 		    criteria == NULL ? "" : " \"",
+ 		    criteria == NULL ? "" : criteria,
+ 		    criteria == NULL ? "" : "\"");
++next:
+ 		free(criteria);
+ 		free(oattrib);
+ 		oattrib = attrib = NULL;
+@@ -1847,6 +1848,7 @@ parse_pubkey_algos:
  			} else if (r != 0) {
  				error("%.200s line %d: glob failed for %s.",
  				    filename, linenum, arg2);
@@ -170,7 +210,109 @@ diff -up openssh-8.5p1/readconf.c.coverity openssh-8.5p1/readconf.c
 diff -up openssh-7.4p1/servconf.c.coverity openssh-7.4p1/servconf.c
 --- openssh-7.4p1/servconf.c.coverity	2016-12-23 16:40:26.896788690 +0100
 +++ openssh-7.4p1/servconf.c	2016-12-23 16:40:26.901788691 +0100
-@@ -1638,8 +1638,9 @@ process_server_config_line(ServerOptions
+@@ -1104,12 +1104,12 @@ match_cfg_line(const char *full_line, in
+ 	}
+ 
+ 	while ((oattrib = argv_next(acp, avp)) != NULL) {
+-		attrib = xstrdup(oattrib);
+ 		/* Terminate on comment */
+-		if (*attrib == '#') {
++		if (*oattrib == '#') {
+ 			argv_consume(acp); /* mark all arguments consumed */
+ 			break;
+ 		}
++		attrib = xstrdup(oattrib);
+ 		arg = NULL;
+ 		attributes++;
+ 		/* Criterion "all" has no argument and must appear alone */
+@@ -1131,13 +1131,13 @@ match_cfg_line(const char *full_line, in
+ 		if (strcasecmp(attrib, "invalid-user") == 0) {
+ 			if (ci == NULL) {
+ 				result = 0;
+-				continue;
++				goto next;
+ 			}
+ 			if (ci->user_invalid == 0)
+ 				result = 0;
+ 			else
+ 				debug("matched invalid-user at line %d", line);
+-			continue;
++			goto next;
+ 		}
+ 
+ 		/* Keep this list in sync with below */
+@@ -1163,7 +1163,7 @@ match_cfg_line(const char *full_line, in
+ 		if (strcasecmp(attrib, "user") == 0) {
+ 			if (ci == NULL || (ci->test && ci->user == NULL)) {
+ 				result = 0;
+-				continue;
++				goto next;
+ 			}
+ 			if (ci->user == NULL)
+ 				match_test_missing_fatal("User", "user");
+@@ -1175,7 +1175,7 @@ match_cfg_line(const char *full_line, in
+ 		} else if (strcasecmp(attrib, "group") == 0) {
+ 			if (ci == NULL || (ci->test && ci->user == NULL)) {
+ 				result = 0;
+-				continue;
++				goto next;
+ 			}
+ 			if (ci->user == NULL)
+ 				match_test_missing_fatal("Group", "user");
+@@ -1189,7 +1189,7 @@ match_cfg_line(const char *full_line, in
+ 		} else if (strcasecmp(attrib, "host") == 0) {
+ 			if (ci == NULL || (ci->test && ci->host == NULL)) {
+ 				result = 0;
+-				continue;
++				goto next;
+ 			}
+ 			if (ci->host == NULL)
+ 				match_test_missing_fatal("Host", "host");
+@@ -1204,7 +1204,7 @@ match_cfg_line(const char *full_line, in
+ 					fatal("Invalid Match address argument "
+ 					    "'%s' at line %d", arg, line);
+ 				result = 0;
+-				continue;
++				goto next;
+ 			}
+ 			if (ci->address == NULL)
+ 				match_test_missing_fatal("Address", "addr");
+@@ -1228,7 +1228,7 @@ match_cfg_line(const char *full_line, in
+ 					    "argument '%s' at line %d", arg,
+ 					    line);
+ 				result = 0;
+-				continue;
++				goto next;
+ 			}
+ 			if (ci->laddress == NULL)
+ 				match_test_missing_fatal("LocalAddress",
+@@ -1256,7 +1256,7 @@ match_cfg_line(const char *full_line, in
+ 			}
+ 			if (ci == NULL || (ci->test && ci->lport == -1)) {
+ 				result = 0;
+-				continue;
++				goto next;
+ 			}
+ 			if (ci->lport == 0)
+ 				match_test_missing_fatal("LocalPort", "lport");
+@@ -1270,7 +1270,7 @@ match_cfg_line(const char *full_line, in
+ 		} else if (strcasecmp(attrib, "rdomain") == 0) {
+ 			if (ci == NULL || (ci->test && ci->rdomain == NULL)) {
+ 				result = 0;
+-				continue;
++				goto next;
+ 			}
+ 			if (ci->rdomain == NULL)
+ 				match_test_missing_fatal("RDomain", "rdomain");
+@@ -1284,6 +1284,7 @@ match_cfg_line(const char *full_line, in
+ 			result = -1;
+ 			goto out;
+ 		}
++next:
+ 		free(attrib);
+ 		attrib = NULL;
+ 	}
+@@ -1638,8 +1639,9 @@ process_server_config_line(ServerOptions
  		if (*activep && *charptr == NULL) {
  			*charptr = tilde_expand_filename(arg, getuid());
  			/* increase optional counter */
@@ -246,3 +388,22 @@ diff -up openssh-8.5p1/ssh-keygen.c.coverity openssh-8.5p1/ssh-keygen.c
  		} else {
  			if (strncasecmp(cp, "key:", 4) == 0) {
  				cp += 4;
+diff -up openssh-9.9p1/sshd.c.coverity openssh-9.9p1/sshd.c
+--- openssh-9.9p1/sshd.c.coverity	2026-04-08 15:19:20.480015568 +0200
++++ openssh-9.9p1/sshd.c	2026-04-08 15:22:10.938328556 +0200
+@@ -1069,6 +1069,7 @@ server_accept_loop(int *sock_in, int *so
+ 				send_rexec_state(config_s[0], cfg);
+ 				close(config_s[0]);
+ 				free(pfd);
++				free(startup_pollfd);
+ 				return;
+ 			}
+ 
+@@ -1101,6 +1102,7 @@ server_accept_loop(int *sock_in, int *so
+ 				    log_stderr);
+ 				close(config_s[0]);
+ 				free(pfd);
++				free(startup_pollfd);
+ 				return;
+ 			}
+ 
diff --git a/SOURCES/openssh-7.2p2-x11.patch b/SOURCES/openssh-7.2p2-x11.patch
index 6db16be..a605a41 100644
--- a/SOURCES/openssh-7.2p2-x11.patch
+++ b/SOURCES/openssh-7.2p2-x11.patch
@@ -32,7 +32,7 @@ diff --git a/channels.c b/channels.c
  	return -1;
  }
 
-@@ -5099,8 +5102,18 @@
+@@ -5099,8 +5102,19 @@
  connect_local_xsocket(u_int dnr)
  {
  	char buf[1024];
@@ -41,10 +41,11 @@ diff --git a/channels.c b/channels.c
 +	int len, ret;
 +	len = snprintf(buf + 1, sizeof (buf) - 1, _PATH_UNIX_X, dnr);
 +#ifdef linux
-+	/* try abstract socket first */
-+	buf[0] = '\0';
-+	if ((ret = connect_local_xsocket_path(buf, len + 1)) >= 0)
-+		return ret;
++	if (getenv("SSH_INSECURE_ABSTRACT_SOCKET_ENABLED") != NULL) {
++		buf[0] = '\0';
++		if ((ret = connect_local_xsocket_path(buf, len + 1)) >= 0)
++			return ret;
++	}
 +#endif
 +	if ((ret = connect_local_xsocket_path(buf + 1, len)) >= 0)
 +		return ret;
diff --git a/SOURCES/openssh-7.7p1-fips.patch b/SOURCES/openssh-7.7p1-fips.patch
index 9f83eee..7ad6b1a 100644
--- a/SOURCES/openssh-7.7p1-fips.patch
+++ b/SOURCES/openssh-7.7p1-fips.patch
@@ -106,17 +106,18 @@ diff -up openssh-8.6p1/kexgexc.c.fips openssh-8.6p1/kexgexc.c
  #include <sys/types.h>
  
  #include <openssl/dh.h>
-@@ -115,6 +116,10 @@ input_kex_dh_gex_group(int type, u_int32
- 		r = SSH_ERR_ALLOC_FAIL;
- 		goto out;
+@@ -117,6 +118,11 @@ input_kex_dh_gex_group(int type, u_int32
  	}
+ 	p = g = NULL; /* belong to kex->dh now */
+ 
 +	if (FIPS_mode() && dh_is_known_group(kex->dh) == 0) {
 +		r = SSH_ERR_INVALID_ARGUMENT;
 +		goto out;
 +	}
- 	p = g = NULL; /* belong to kex->dh now */
- 
++
  	/* generate and send 'e', client DH public key */
+ 	if ((r = dh_gen_key(kex->dh, kex->we_need * 8)) != 0)
+ 		goto out;
 diff -up openssh-8.6p1/myproposal.h.fips openssh-8.6p1/myproposal.h
 --- openssh-8.6p1/myproposal.h.fips	2021-04-16 05:55:25.000000000 +0200
 +++ openssh-8.6p1/myproposal.h	2021-05-06 12:08:36.498926877 +0200
diff --git a/SOURCES/openssh-9.6p1-gssapi-keyex.patch b/SOURCES/openssh-9.6p1-gssapi-keyex.patch
index ef1f97e..16892ac 100644
--- a/SOURCES/openssh-9.6p1-gssapi-keyex.patch
+++ b/SOURCES/openssh-9.6p1-gssapi-keyex.patch
@@ -1240,7 +1240,7 @@ diff --color -ruNp a/kexgen.c b/kexgen.c
      const struct sshbuf *client_version,
 diff --color -ruNp a/kexgssc.c b/kexgssc.c
 --- a/kexgssc.c	1970-01-01 01:00:00.000000000 +0100
-+++ b/kexgssc.c	2024-10-14 15:18:02.491798105 +0200
++++ b/kexgssc.c	2026-03-13 12:25:23.115812190 +0100
 @@ -0,0 +1,706 @@
 +/*
 + * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
@@ -1369,7 +1369,7 @@ diff --color -ruNp a/kexgssc.c b/kexgssc.c
 +
 +	/* Verify that the hash matches the MIC we just got. */
 +	if (GSS_ERROR(ssh_gssapi_checkmic(gss, &gss->buf, &gss->msg_tok)))
-+		sshpkt_disconnect(ssh, "Hash's MIC didn't verify");
++		ssh_packet_disconnect(ssh, "Hash's MIC didn't verify");
 +
 +	gss_release_buffer(&gss->minor, &gss->msg_tok);
 +
@@ -1592,10 +1592,10 @@ diff --color -ruNp a/kexgssc.c b/kexgssc.c
 +			fatal("Failed to read token: %s", ssh_err(r));
 +		/* If we're already complete - protocol error */
 +		if (gss->major == GSS_S_COMPLETE)
-+			sshpkt_disconnect(ssh, "Protocol error: received token when complete");
++			ssh_packet_disconnect(ssh, "Protocol error: received token when complete");
 +	} else {
 +		if (gss->major != GSS_S_COMPLETE)
-+			sshpkt_disconnect(ssh, "Protocol error: did not receive final token");
++			ssh_packet_disconnect(ssh, "Protocol error: did not receive final token");
 +	}
 +	if ((r = sshpkt_get_end(ssh)) != 0)
 +		fatal("Expecting end of packet.");
@@ -1731,7 +1731,7 @@ diff --color -ruNp a/kexgssc.c b/kexgssc.c
 +
 +	/* Verify that the hash matches the MIC we just got. */
 +	if (GSS_ERROR(ssh_gssapi_checkmic(gss, &gss->buf, &gss->msg_tok)))
-+		sshpkt_disconnect(ssh, "Hash's MIC didn't verify");
++		ssh_packet_disconnect(ssh, "Hash's MIC didn't verify");
 +
 +	gss_release_buffer(&gss->minor, &gss->msg_tok);
 +
@@ -1932,10 +1932,10 @@ diff --color -ruNp a/kexgssc.c b/kexgssc.c
 +			fatal("Failed to read token: %s", ssh_err(r));
 +		/* If we're already complete - protocol error */
 +		if (gss->major == GSS_S_COMPLETE)
-+			sshpkt_disconnect(ssh, "Protocol error: received token when complete");
++			ssh_packet_disconnect(ssh, "Protocol error: received token when complete");
 +	} else {
 +		if (gss->major != GSS_S_COMPLETE)
-+			sshpkt_disconnect(ssh, "Protocol error: did not receive final token");
++			ssh_packet_disconnect(ssh, "Protocol error: did not receive final token");
 +	}
 +	if ((r = sshpkt_get_end(ssh)) != 0)
 +		fatal("Expecting end of packet.");
@@ -1950,8 +1950,8 @@ diff --color -ruNp a/kexgssc.c b/kexgssc.c
 +#endif /* defined(GSSAPI) && defined(WITH_OPENSSL) */
 diff --color -ruNp a/kexgsss.c b/kexgsss.c
 --- a/kexgsss.c	1970-01-01 01:00:00.000000000 +0100
-+++ b/kexgsss.c	2024-10-14 15:18:02.491798105 +0200
-@@ -0,0 +1,601 @@
++++ b/kexgsss.c	2026-03-13 12:32:17.556172591 +0100
+@@ -0,0 +1,603 @@
 +/*
 + * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
 + *
@@ -2083,7 +2083,7 @@ diff --color -ruNp a/kexgsss.c b/kexgsss.c
 +{
 +	struct kex *kex = ssh->kex;
 +	Gssctxt *gss = kex->gss;
-+	gss_buffer_desc msg_tok;
++	gss_buffer_desc msg_tok = GSS_C_EMPTY_BUFFER;
 +	u_char hash[SSH_DIGEST_MAX_LENGTH];
 +	size_t hashlen;
 +	struct sshbuf *shared_secret = NULL;
@@ -2167,7 +2167,8 @@ diff --color -ruNp a/kexgsss.c b/kexgsss.c
 +	Gssctxt *gss = kex->gss;
 +	struct sshbuf *empty;
 +	struct sshbuf *client_pubkey = NULL;
-+	gss_buffer_desc recv_tok, send_tok = GSS_C_EMPTY_BUFFER;
++	gss_buffer_desc recv_tok = GSS_C_EMPTY_BUFFER;
++	gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
 +	OM_uint32 ret_flags = 0;
 +	int r;
 +
@@ -2243,7 +2244,8 @@ diff --color -ruNp a/kexgsss.c b/kexgsss.c
 +		      struct ssh *ssh)
 +{
 +	Gssctxt *gss = ssh->kex->gss;
-+	gss_buffer_desc recv_tok, send_tok = GSS_C_EMPTY_BUFFER;
++	gss_buffer_desc recv_tok = GSS_C_EMPTY_BUFFER;
++	gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
 +	OM_uint32 ret_flags = 0;
 +	int r;
 +
@@ -2334,7 +2336,7 @@ diff --color -ruNp a/kexgsss.c b/kexgsss.c
 +{
 +	struct kex *kex = ssh->kex;
 +	Gssctxt *gss = kex->gss;
-+	gss_buffer_desc msg_tok;
++	gss_buffer_desc msg_tok = GSS_C_EMPTY_BUFFER;
 +	u_char hash[SSH_DIGEST_MAX_LENGTH];
 +	size_t hashlen;
 +	const BIGNUM *pub_key, *dh_p, *dh_g;
@@ -2475,10 +2477,8 @@ diff --color -ruNp a/kexgsss.c b/kexgsss.c
 +		fatal("GSS_GEX, bad parameters: %d !< %d !< %d", min, nbits, max);
 +
 +	kex->dh = mm_choose_dh(min, nbits, max);
-+	if (kex->dh == NULL) {
-+		sshpkt_disconnect(ssh, "Protocol error: no matching group found");
-+		fatal("Protocol error: no matching group found");
-+	}
++	if (kex->dh == NULL)
++		ssh_packet_disconnect(ssh, "Protocol error: no matching group found");
 +
 +	DH_get0_pqg(kex->dh, &dh_p, NULL, &dh_g);
 +	if ((r = sshpkt_start(ssh, SSH2_MSG_KEXGSS_GROUP)) != 0 ||
@@ -2510,7 +2510,8 @@ diff --color -ruNp a/kexgsss.c b/kexgsss.c
 +		     struct ssh *ssh)
 +{
 +	Gssctxt *gss = ssh->kex->gss;
-+	gss_buffer_desc recv_tok, send_tok = GSS_C_EMPTY_BUFFER;
++	gss_buffer_desc recv_tok = GSS_C_EMPTY_BUFFER;
++	gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
 +	OM_uint32 ret_flags = 0;
 +	int r;
 +
@@ -2537,7 +2538,8 @@ diff --color -ruNp a/kexgsss.c b/kexgsss.c
 +			 struct ssh *ssh)
 +{
 +	Gssctxt *gss = ssh->kex->gss;
-+	gss_buffer_desc recv_tok, send_tok = GSS_C_EMPTY_BUFFER;
++	gss_buffer_desc recv_tok = GSS_C_EMPTY_BUFFER;
++	gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
 +	OM_uint32 ret_flags = 0;
 +	int r;
 +
diff --git a/SOURCES/openssh-9.9p1-authorized-keys-principles-option.patch b/SOURCES/openssh-9.9p1-authorized-keys-principles-option.patch
new file mode 100644
index 0000000..9bdd199
--- /dev/null
+++ b/SOURCES/openssh-9.9p1-authorized-keys-principles-option.patch
@@ -0,0 +1,45 @@
+diff --color -ruNp a/auth2-pubkeyfile.c b/auth2-pubkeyfile.c
+--- a/auth2-pubkeyfile.c	2024-09-20 00:20:48.000000000 +0200
++++ b/auth2-pubkeyfile.c	2026-04-09 14:38:41.697178612 +0200
+@@ -50,6 +50,7 @@
+ #include "authfile.h"
+ #include "match.h"
+ #include "ssherr.h"
++#include "xmalloc.h"
+ 
+ int
+ auth_authorise_keyopts(struct passwd *pw, struct sshauthopt *opts,
+@@ -146,20 +147,23 @@ auth_authorise_keyopts(struct passwd *pw
+ static int
+ match_principals_option(const char *principal_list, struct sshkey_cert *cert)
+ {
+-	char *result;
++	char *list, *olist, *entry;
+ 	u_int i;
+ 
+-	/* XXX percent_expand() sequences for authorized_principals? */
+-
+-	for (i = 0; i < cert->nprincipals; i++) {
+-		if ((result = match_list(cert->principals[i],
+-		    principal_list, NULL)) != NULL) {
+-			debug3("matched principal from key options \"%.100s\"",
+-			    result);
+-			free(result);
+-			return 1;
++	olist = list = xstrdup(principal_list);
++	for (;;) {
++		if ((entry = strsep(&list, ",")) == NULL || *entry == '\0')
++			break;
++		for (i = 0; i < cert->nprincipals; i++) {
++			if (strcmp(entry, cert->principals[i]) == 0) {
++				debug3("matched principal from key i"
++				    "options \"%.100s\"", entry);
++				free(olist);
++				return 1;
++			}
+ 		}
+ 	}
++	free(olist);
+ 	return 0;
+ }
+ 
diff --git a/SOURCES/openssh-9.9p1-cve-2026-60002.patch b/SOURCES/openssh-9.9p1-cve-2026-60002.patch
new file mode 100644
index 0000000..ab16479
--- /dev/null
+++ b/SOURCES/openssh-9.9p1-cve-2026-60002.patch
@@ -0,0 +1,191 @@
+diff --color -ruNp a/ssh.c b/ssh.c
+--- a/ssh.c	2026-07-14 11:58:09.036496915 +0200
++++ b/ssh.c	2026-07-14 12:00:55.044542741 +0200
+@@ -619,26 +619,6 @@ set_addrinfo_port(struct addrinfo *addrs
+ 	}
+ }
+ 
+-static void
+-ssh_conn_info_free(struct ssh_conn_info *cinfo)
+-{
+-	if (cinfo == NULL)
+-		return;
+-	free(cinfo->conn_hash_hex);
+-	free(cinfo->shorthost);
+-	free(cinfo->uidstr);
+-	free(cinfo->keyalias);
+-	free(cinfo->thishost);
+-	free(cinfo->host_arg);
+-	free(cinfo->portstr);
+-	free(cinfo->remhost);
+-	free(cinfo->remuser);
+-	free(cinfo->homedir);
+-	free(cinfo->locuser);
+-	free(cinfo->jmphost);
+-	free(cinfo);
+-}
+-
+ /*
+  * Main program for the ssh client.
+  */
+@@ -1765,8 +1745,8 @@ main(int ac, char **av)
+ 	ssh_signal(SIGCHLD, main_sigchld_handler);
+ 
+ 	/* Log into the remote system.  Never returns if the login fails. */
+-	ssh_login(ssh, &sensitive_data, host, (struct sockaddr *)&hostaddr,
+-	    options.port, pw, timeout_ms, cinfo);
++	ssh_login(ssh, &sensitive_data, host, &hostaddr, options.port,
++	    pw, timeout_ms, cinfo);
+ 
+ 	/* We no longer need the private host keys.  Clear them now. */
+ 	if (sensitive_data.nkeys != 0) {
+diff --color -ruNp a/sshconnect2.c b/sshconnect2.c
+--- a/sshconnect2.c	2026-07-14 11:58:09.031477028 +0200
++++ b/sshconnect2.c	2026-07-14 12:01:56.374803123 +0200
+@@ -89,7 +89,7 @@ extern Options options;
+  */
+ 
+ static char *xxx_host;
+-static struct sockaddr *xxx_hostaddr;
++static struct sockaddr_storage xxx_hostaddr;
+ static const struct ssh_conn_info *xxx_conn_info;
+ static int key_type_allowed(struct sshkey *, const char *);
+ 
+@@ -105,7 +105,7 @@ verify_host_key_callback(struct sshkey *
+ 		fatal("Server host key %s not in HostKeyAlgorithms",
+ 		    sshkey_ssh_name(hostkey));
+ 	}
+-	if (verify_host_key(xxx_host, xxx_hostaddr, hostkey,
++	if (verify_host_key(xxx_host, (struct sockaddr *)&xxx_hostaddr, hostkey,
+ 	    xxx_conn_info) != 0)
+ 		fatal("Host key verification failed.");
+ 	return 0;
+@@ -222,8 +222,8 @@ order_hostkeyalgs(char *host, struct soc
+ }
+ 
+ void
+-ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
+-    const struct ssh_conn_info *cinfo)
++ssh_kex2(struct ssh *ssh, char *host, struct sockaddr_storage *hostaddr,
++    u_short port, const struct ssh_conn_info *cinfo)
+ {
+ 	char *myproposal[PROPOSAL_MAX];
+ 	char *all_key, *hkalgs = NULL, *filtered_algs = NULL;
+@@ -234,9 +234,9 @@ ssh_kex2(struct ssh *ssh, char *host, st
+ 	char *gss_host = NULL;
+ #endif
+ 
+-	xxx_host = host;
+-	xxx_hostaddr = hostaddr;
+-	xxx_conn_info = cinfo;
++	xxx_host = xstrdup(host);
++	xxx_hostaddr = *hostaddr;
++	xxx_conn_info = ssh_conn_info_dup(cinfo);
+ 
+ 	if (options.rekey_limit || options.rekey_interval)
+ 		ssh_packet_set_rekey_limits(ssh, options.rekey_limit,
+@@ -259,8 +259,10 @@ ssh_kex2(struct ssh *ssh, char *host, st
+ 		fatal_fr(r, "kex_assemble_namelist");
+ 	free(all_key);
+ 
+-	if (use_known_hosts_order)
+-		hkalgs = order_hostkeyalgs(host, hostaddr, port, cinfo);
++	if (use_known_hosts_order) {
++		hkalgs = order_hostkeyalgs(host, (struct sockaddr *)hostaddr,
++		    port, cinfo);
++	}
+ 
+ 	filtered_algs = hkalgs ? match_filter_allowlist(hkalgs, options.pubkey_accepted_algos)
+ 		               : match_filter_allowlist(options.hostkeyalgorithms,
+diff --color -ruNp a/sshconnect.c b/sshconnect.c
+--- a/sshconnect.c	2026-07-14 11:58:08.892659011 +0200
++++ b/sshconnect.c	2026-07-14 12:00:55.045767462 +0200
+@@ -84,6 +84,49 @@ extern char *__progname;
+ static int show_other_keys(struct hostkeys *, struct sshkey *);
+ static void warn_changed_key(struct sshkey *);
+ 
++void
++ssh_conn_info_free(struct ssh_conn_info *cinfo)
++{
++	if (cinfo == NULL)
++		return;
++	free(cinfo->conn_hash_hex);
++	free(cinfo->shorthost);
++	free(cinfo->uidstr);
++	free(cinfo->keyalias);
++	free(cinfo->thishost);
++	free(cinfo->host_arg);
++	free(cinfo->portstr);
++	free(cinfo->remhost);
++	free(cinfo->remuser);
++	free(cinfo->homedir);
++	free(cinfo->locuser);
++	free(cinfo->jmphost);
++	freezero(cinfo, sizeof(*cinfo));
++}
++
++struct ssh_conn_info *
++ssh_conn_info_dup(const struct ssh_conn_info *cinfo)
++{
++	struct ssh_conn_info *ret;
++
++	if (cinfo == NULL)
++		return NULL;
++	ret = xcalloc(1, sizeof(*ret));
++	ret->conn_hash_hex = xstrdup(cinfo->conn_hash_hex);
++	ret->shorthost = xstrdup(cinfo->shorthost);
++	ret->uidstr = xstrdup(cinfo->uidstr);
++	ret->keyalias = xstrdup(cinfo->keyalias);
++	ret->thishost = xstrdup(cinfo->thishost);
++	ret->host_arg = xstrdup(cinfo->host_arg);
++	ret->portstr = xstrdup(cinfo->portstr);
++	ret->remhost = xstrdup(cinfo->remhost);
++	ret->remuser = xstrdup(cinfo->remuser);
++	ret->homedir = xstrdup(cinfo->homedir);
++	ret->locuser = xstrdup(cinfo->locuser);
++	ret->jmphost = xstrdup(cinfo->jmphost);
++	return ret;
++}
++
+ /* Expand a proxy command */
+ static char *
+ expand_proxy_command(const char *proxy_command, const char *user,
+@@ -1589,8 +1632,8 @@ out:
+  */
+ void
+ ssh_login(struct ssh *ssh, Sensitive *sensitive, const char *orighost,
+-    struct sockaddr *hostaddr, u_short port, struct passwd *pw, int timeout_ms,
+-    const struct ssh_conn_info *cinfo)
++    struct sockaddr_storage *hostaddr, u_short port, struct passwd *pw,
++    int timeout_ms, const struct ssh_conn_info *cinfo)
+ {
+ 	char *host;
+ 	char *server_user, *local_user;
+diff --color -ruNp a/sshconnect.h b/sshconnect.h
+--- a/sshconnect.h	2024-09-20 00:20:48.000000000 +0200
++++ b/sshconnect.h	2026-07-14 12:00:55.045948953 +0200
+@@ -73,7 +73,7 @@ int	 ssh_connect(struct ssh *, const cha
+ void	 ssh_kill_proxy_command(void);
+ 
+ void	 ssh_login(struct ssh *, Sensitive *, const char *,
+-    struct sockaddr *, u_short, struct passwd *, int,
++    struct sockaddr_storage *, u_short, struct passwd *, int,
+     const struct ssh_conn_info *);
+ 
+ int	 verify_host_key(char *, struct sockaddr *, struct sshkey *,
+@@ -82,7 +82,7 @@ int	 verify_host_key(char *, struct sock
+ void	 get_hostfile_hostname_ipaddr(char *, struct sockaddr *, u_short,
+     char **, char **);
+ 
+-void	 ssh_kex2(struct ssh *ssh, char *, struct sockaddr *, u_short,
++void	 ssh_kex2(struct ssh *ssh, char *, struct sockaddr_storage *, u_short,
+     const struct ssh_conn_info *);
+ 
+ void	 ssh_userauth2(struct ssh *ssh, const char *, const char *,
+@@ -98,3 +98,6 @@ void	 load_hostkeys_command(struct hostk
+     const struct sshkey *, const char *);
+ 
+ int hostkey_accepted_by_hostkeyalgs(const struct sshkey *);
++
++void ssh_conn_info_free(struct ssh_conn_info *);
++struct ssh_conn_info *ssh_conn_info_dup(const struct ssh_conn_info *);
diff --git a/SOURCES/openssh-9.9p1-ecdsa-incomplete-application.patch b/SOURCES/openssh-9.9p1-ecdsa-incomplete-application.patch
new file mode 100644
index 0000000..3b93ca4
--- /dev/null
+++ b/SOURCES/openssh-9.9p1-ecdsa-incomplete-application.patch
@@ -0,0 +1,103 @@
+diff --color -ruNp a/auth2-hostbased.c b/auth2-hostbased.c
+--- a/auth2-hostbased.c	2026-04-09 13:22:28.114045749 +0200
++++ b/auth2-hostbased.c	2026-04-09 14:34:44.876393822 +0200
+@@ -96,9 +96,10 @@ userauth_hostbased(struct ssh *ssh, cons
+ 		error_f("cannot decode key: %s", pkalg);
+ 		goto done;
+ 	}
+-	if (key->type != pktype) {
+-		error_f("type mismatch for decoded key "
+-		    "(received %d, expected %d)", key->type, pktype);
++	if (key->type != pktype || (sshkey_type_plain(pktype) == KEY_ECDSA &&
++	    sshkey_ecdsa_nid_from_name(pkalg) != key->ecdsa_nid)) {
++		error_f("key type mismatch for decoded key "
++		    "(received %s, expected %s)", sshkey_ssh_name(key), pkalg);
+ 		goto done;
+ 	}
+ 	if (match_pattern_list(pkalg, options.hostbased_accepted_algos, 0) != 1) {
+diff --color -ruNp a/auth2-pubkey.c b/auth2-pubkey.c
+--- a/auth2-pubkey.c	2026-04-09 13:22:28.157194118 +0200
++++ b/auth2-pubkey.c	2026-04-09 14:35:48.997689347 +0200
+@@ -152,9 +152,10 @@ userauth_pubkey(struct ssh *ssh, const c
+ 		error_f("cannot decode key: %s", pkalg);
+ 		goto done;
+ 	}
+-	if (key->type != pktype) {
+-		error_f("type mismatch for decoded key "
+-		    "(received %d, expected %d)", key->type, pktype);
++	if (key->type != pktype || (sshkey_type_plain(pktype) == KEY_ECDSA &&
++	    sshkey_ecdsa_nid_from_name(pkalg) != key->ecdsa_nid)) {
++		error_f("key type mismatch for decoded key "
++		    "(received %s, expected %s)", sshkey_ssh_name(key), pkalg);
+ 		goto done;
+ 	}
+ 	if (auth2_key_already_used(authctxt, key)) {
+diff --color -ruNp a/sshconnect2.c b/sshconnect2.c
+--- a/sshconnect2.c	2026-04-09 13:22:28.193412553 +0200
++++ b/sshconnect2.c	2026-04-09 14:42:37.644945762 +0200
+@@ -91,6 +91,7 @@ extern Options options;
+ static char *xxx_host;
+ static struct sockaddr *xxx_hostaddr;
+ static const struct ssh_conn_info *xxx_conn_info;
++static int key_type_allowed(struct sshkey *, const char *);
+ 
+ static int
+ verify_host_key_callback(struct sshkey *hostkey, struct ssh *ssh)
+@@ -100,6 +101,10 @@ verify_host_key_callback(struct sshkey *
+ 	if ((r = sshkey_check_rsa_length(hostkey,
+ 	    options.required_rsa_size)) != 0)
+ 		fatal_r(r, "Bad server host key");
++	if (!key_type_allowed(hostkey, options.hostkeyalgorithms)) {
++		fatal("Server host key %s not in HostKeyAlgorithms",
++		    sshkey_ssh_name(hostkey));
++	}
+ 	if (verify_host_key(xxx_host, xxx_hostaddr, hostkey,
+ 	    xxx_conn_info) != 0)
+ 		fatal("Host key verification failed.");
+@@ -1776,34 +1781,37 @@ load_identity_file(Identity *id)
+ }
+ 
+ static int
+-key_type_allowed_by_config(struct sshkey *key)
++key_type_allowed(struct sshkey *key, const char *allowlist)
+ {
+-	if (match_pattern_list(sshkey_ssh_name(key),
+-	    options.pubkey_accepted_algos, 0) == 1)
++	if (match_pattern_list(sshkey_ssh_name(key), allowlist, 0) == 1)
+ 		return 1;
+ 
+ 	/* RSA keys/certs might be allowed by alternate signature types */
+ 	switch (key->type) {
+ 	case KEY_RSA:
+-		if (match_pattern_list("rsa-sha2-512",
+-		    options.pubkey_accepted_algos, 0) == 1)
++		if (match_pattern_list("rsa-sha2-512", allowlist, 0) == 1)
+ 			return 1;
+-		if (match_pattern_list("rsa-sha2-256",
+-		    options.pubkey_accepted_algos, 0) == 1)
++		if (match_pattern_list("rsa-sha2-256", allowlist, 0) == 1)
+ 			return 1;
+ 		break;
+ 	case KEY_RSA_CERT:
+ 		if (match_pattern_list("rsa-sha2-512-cert-v01@openssh.com",
+-		    options.pubkey_accepted_algos, 0) == 1)
++		    allowlist, 0) == 1)
+ 			return 1;
+ 		if (match_pattern_list("rsa-sha2-256-cert-v01@openssh.com",
+-		    options.pubkey_accepted_algos, 0) == 1)
++		    allowlist, 0) == 1)
+ 			return 1;
+ 		break;
+ 	}
+ 	return 0;
+ }
+ 
++static int
++key_type_allowed_by_config(struct sshkey *key)
++{
++	return key_type_allowed(key, options.pubkey_accepted_algos);
++}
++
+ /* obtain a list of keys from the agent */
+ static int
+ get_agent_identities(struct ssh *ssh, int *agent_fdp,
diff --git a/SOURCES/openssh-9.9p1-fill-default-options-error.patch b/SOURCES/openssh-9.9p1-fill-default-options-error.patch
new file mode 100644
index 0000000..4b80504
--- /dev/null
+++ b/SOURCES/openssh-9.9p1-fill-default-options-error.patch
@@ -0,0 +1,24 @@
+diff --color -ruNp a/readconf.c b/readconf.c
+--- a/readconf.c	2026-04-02 15:36:49.624394836 +0200
++++ b/readconf.c	2026-04-02 15:43:15.115047190 +0200
+@@ -2779,7 +2779,7 @@ fill_default_options(Options * options)
+ {
+ 	char *all_cipher, *all_mac, *all_kex, *all_key, *all_sig;
+ 	char *def_cipher, *def_mac, *def_kex, *def_key, *def_sig;
+-	int ret = 0, r;
++	int ret = 0;
+ 
+ 	if (options->forward_agent == -1)
+ 		options->forward_agent = 0;
+@@ -2989,9 +2989,9 @@ fill_default_options(Options * options)
+ 	    KEX_FIPS_PK_ALG : SSH_ALLOWED_CA_SIGALGS), all_sig);
+ #define ASSEMBLE(what, defaults, all) \
+ 	do { \
+-		if ((r = kex_assemble_names(&options->what, \
++		if ((ret = kex_assemble_names(&options->what, \
+ 		    defaults, all)) != 0) { \
+-			error_fr(r, "%s", #what); \
++			error_fr(ret, "%s", #what); \
+ 			goto fail; \
+ 		} \
+ 	} while (0)
diff --git a/SOURCES/openssh-9.9p1-maxstartups-mistracking.patch b/SOURCES/openssh-9.9p1-maxstartups-mistracking.patch
new file mode 100644
index 0000000..0e92903
--- /dev/null
+++ b/SOURCES/openssh-9.9p1-maxstartups-mistracking.patch
@@ -0,0 +1,73 @@
+diff --color -ruNp a/srclimit.c b/srclimit.c
+--- a/srclimit.c	2024-09-20 00:20:48.000000000 +0200
++++ b/srclimit.c	2026-03-06 13:30:48.408309619 +0100
+@@ -427,7 +427,9 @@ srclimit_penalise(struct xaddr *addr, in
+ 			penalty->active = 1;
+ 		if (RB_INSERT(penalties_by_expiry, by_expiry, penalty) != NULL)
+ 			fatal_f("internal error: %s penalty tables corrupt", t);
+-		verbose_f("%s: new %s %s penalty of %d seconds for %s", t,
++		do_log2_f(penalty->active ?
++		    SYSLOG_LEVEL_INFO : SYSLOG_LEVEL_VERBOSE,
++		    "%s: new %s %s penalty of %d seconds for %s", t,
+ 		    addrnetmask, penalty->active ? "active" : "deferred",
+ 		    penalty_secs, reason);
+ 		if (++(*npenaltiesp) > (size_t)max_sources)
+@@ -446,7 +448,7 @@ srclimit_penalise(struct xaddr *addr, in
+ 		existing->expiry = now + penalty_cfg.penalty_max;
+ 	if (existing->expiry - now > penalty_cfg.penalty_min &&
+ 	    !existing->active) {
+-		verbose_f("%s: activating %s penalty of %lld seconds for %s",
++		logit_f("%s: activating %s penalty of %lld seconds for %s",
+ 		    addrnetmask, t, (long long)(existing->expiry - now),
+ 		    reason);
+ 		existing->active = 1;
+diff --color -ruNp a/sshd.c b/sshd.c
+--- a/sshd.c	2026-03-06 13:10:52.653617548 +0100
++++ b/sshd.c	2026-03-06 13:24:50.865079998 +0100
+@@ -291,8 +291,10 @@ child_finish(struct early_child *child)
+ {
+ 	if (children_active == 0)
+ 		fatal_f("internal error: children_active underflow");
+-	if (child->pipefd != -1)
++	if (child->pipefd != -1) {
++		srclimit_done(child->pipefd);
+ 		close(child->pipefd);
++	}
+ 	free(child->id);
+ 	memset(child, '\0', sizeof(*child));
+ 	child->pipefd = -1;
+@@ -311,6 +313,7 @@ child_close(struct early_child *child, i
+ 	if (!quiet)
+ 		debug_f("enter%s", force_final ? " (forcing)" : "");
+ 	if (child->pipefd != -1) {
++		srclimit_done(child->pipefd);
+ 		close(child->pipefd);
+ 		child->pipefd = -1;
+ 	}
+@@ -978,10 +981,11 @@ server_accept_loop(int *sock_in, int *so
+ 				}
+ 				/* FALLTHROUGH */
+ 			case 0:
+-				/* child exited preauth */
++				/* child closed pipe */
+ 				if (children[i].early)
+ 					listening--;
+-				srclimit_done(children[i].pipefd);
++				debug3_f("child %lu for %s closed pipe",
++				    (long)children[i].pid, children[i].id);
+ 				child_close(&(children[i]), 0, 0);
+ 				break;
+ 			case 1:
+@@ -1003,6 +1007,12 @@ server_accept_loop(int *sock_in, int *so
+ 					    "child %ld for %s in state %d",
+ 					    (int)c, (long)children[i].pid,
+ 					    children[i].id, children[i].early);
++
++					if (children[i].early)
++						listening--;
++					if (children[i].pid > 0)
++						kill(children[i].pid, SIGTERM);
++					child_close(&(children[i]), 0, 0);
+ 				}
+ 				break;
+ 			}
diff --git a/SOURCES/openssh-9.9p1-mux-askpass-check.patch b/SOURCES/openssh-9.9p1-mux-askpass-check.patch
new file mode 100644
index 0000000..2176243
--- /dev/null
+++ b/SOURCES/openssh-9.9p1-mux-askpass-check.patch
@@ -0,0 +1,20 @@
+diff --color -ruNp a/mux.c b/mux.c
+--- a/mux.c	2024-09-20 00:20:48.000000000 +0200
++++ b/mux.c	2026-04-09 15:02:36.016198814 +0200
+@@ -1137,6 +1137,16 @@ mux_master_process_proxy(struct ssh *ssh
+ 
+ 	debug_f("channel %d: proxy request", c->self);
+ 
++	if (options.control_master == SSHCTL_MASTER_ASK ||
++	    options.control_master == SSHCTL_MASTER_AUTO_ASK) {
++		if (!ask_permission("Allow multiplex proxy connection?")) {
++			debug2_f("proxy refused by user");
++			reply_error(reply, MUX_S_PERMISSION_DENIED, rid,
++			    "Permission denied");
++			return 0;
++		}
++	}
++
+ 	c->mux_rcb = channel_proxy_downstream;
+ 	if ((r = sshbuf_put_u32(reply, MUX_S_PROXY)) != 0 ||
+ 	    (r = sshbuf_put_u32(reply, rid)) != 0)
diff --git a/SOURCES/openssh-9.9p1-proxyjump-username-validity-checks.patch b/SOURCES/openssh-9.9p1-proxyjump-username-validity-checks.patch
new file mode 100644
index 0000000..c6ee415
--- /dev/null
+++ b/SOURCES/openssh-9.9p1-proxyjump-username-validity-checks.patch
@@ -0,0 +1,402 @@
+diff --color -ruNp a/readconf.c b/readconf.c
+--- a/readconf.c	2026-04-10 15:42:50.693725820 +0200
++++ b/readconf.c	2026-04-10 15:49:57.441110287 +0200
+@@ -1533,9 +1533,6 @@ parse_char_array:
+ 
+ 	case oProxyCommand:
+ 		charptr = &options->proxy_command;
+-		/* Ignore ProxyCommand if ProxyJump already specified */
+-		if (options->jump_host != NULL)
+-			charptr = &options->jump_host; /* Skip below */
+ parse_command:
+ 		if (str == NULL) {
+ 			error("%.200s line %d: Missing argument.",
+@@ -1556,7 +1553,7 @@ parse_command:
+ 		}
+ 		len = strspn(str, WHITESPACE "=");
+ 		/* XXX use argv? */
+-		if (parse_jump(str + len, options, *activep) == -1) {
++		if (parse_jump(str + len, options, cmdline, *activep) == -1) {
+ 			error("%.200s line %d: Invalid ProxyJump \"%s\"",
+ 			    filename, linenum, str + len);
+ 			goto out;
+@@ -3370,65 +3367,116 @@ parse_forward(struct Forward *fwd, const
+ }
+ 
+ int
+-parse_jump(const char *s, Options *o, int active)
++ssh_valid_hostname(const char *s)
+ {
+-	char *orig, *sdup, *cp;
+-	char *host = NULL, *user = NULL;
+-	int r, ret = -1, port = -1, first;
++	size_t i;
+ 
+-	active &= o->proxy_command == NULL && o->jump_host == NULL;
++	if (*s == '-')
++		return 0;
++	for (i = 0; s[i] != 0; i++) {
++		if (strchr("'`\"$\\;&<>|(){},", s[i]) != NULL ||
++		    isspace((u_char)s[i]) || iscntrl((u_char)s[i]))
++			return 0;
++	}
++	return 1;
++}
+ 
+-	orig = sdup = xstrdup(s);
++int
++ssh_valid_ruser(const char *s)
++{
++	size_t i;
++
++	if (*s == '-')
++		return 0;
++	for (i = 0; s[i] != 0; i++) {
++		if (iscntrl((u_char)s[i]))
++			return 0;
++		if (strchr("'`\";&<>|(){}", s[i]) != NULL)
++			return 0;
++		/* Disallow '-' after whitespace */
++		if (isspace((u_char)s[i]) && s[i + 1] == '-')
++			return 0;
++		/* Disallow \ in last position */
++		if (s[i] == '\\' && s[i + 1] == '\0')
++			return 0;
++	}
++	return 1;
++}
++
++int
++parse_jump(const char *s, Options *o, int strict, int active)
++{
++	char *orig = NULL, *sdup = NULL, *cp;
++	char *tmp_user = NULL, *tmp_host = NULL, *host = NULL, *user = NULL;
++	int r, ret = -1, tmp_port = -1, port = -1, first = 1;
++
++	if (strcasecmp(s, "none") == 0) {
++		if (active && o->jump_host == NULL) {
++			o->jump_host = xstrdup("none");
++			o->jump_port = 0;
++		}
++		return 0;
++	}
+ 
+-	/* Remove comment and trailing whitespace */
++	orig = xstrdup(s);
+ 	if ((cp = strchr(orig, '#')) != NULL)
+ 		*cp = '\0';
+ 	rtrim(orig);
+ 
+-	first = active;
++	active &= o->proxy_command == NULL && o->jump_host == NULL;
++	sdup = xstrdup(orig);
+ 	do {
+-		if (strcasecmp(s, "none") == 0)
+-			break;
++		/* Work backwards through string */
+ 		if ((cp = strrchr(sdup, ',')) == NULL)
+ 			cp = sdup; /* last */
+ 		else
+ 			*cp++ = '\0';
+ 
+-		if (first) {
+-			/* First argument and configuration is active */
+-			r = parse_ssh_uri(cp, &user, &host, &port);
+-			if (r == -1 || (r == 1 &&
+-			    parse_user_host_port(cp, &user, &host, &port) != 0))
++		r = parse_ssh_uri(cp, &tmp_user, &tmp_host, &tmp_port);
++		if (r == -1 || (r == 1 && parse_user_host_port(cp,
++		    &tmp_user, &tmp_host, &tmp_port) != 0))
++			goto out; /* error already logged */
++		if (strict) {
++			if (!ssh_valid_hostname(tmp_host)) {
++				error_f("invalid hostname \"%s\"", tmp_host);
+ 				goto out;
+-		} else {
+-			/* Subsequent argument or inactive configuration */
+-			r = parse_ssh_uri(cp, NULL, NULL, NULL);
+-			if (r == -1 || (r == 1 &&
+-			    parse_user_host_port(cp, NULL, NULL, NULL) != 0))
++			}
++			if (tmp_user != NULL && !ssh_valid_ruser(tmp_user)) {
++				error_f("invalid username \"%s\"", tmp_user);
+ 				goto out;
++			}
++		}
++		if (first) {
++			user = tmp_user;
++			host = tmp_host;
++			port = tmp_port;
++			tmp_user = tmp_host = NULL; /* transferred */
+ 		}
+ 		first = 0; /* only check syntax for subsequent hosts */
++		free(tmp_user);
++		free(tmp_host);
++		tmp_user = tmp_host = NULL;
++		tmp_port = -1;
+ 	} while (cp != sdup);
++
+ 	/* success */
+ 	if (active) {
+-		if (strcasecmp(s, "none") == 0) {
+-			o->jump_host = xstrdup("none");
+-			o->jump_port = 0;
+-		} else {
+-			o->jump_user = user;
+-			o->jump_host = host;
+-			o->jump_port = port;
+-			o->proxy_command = xstrdup("none");
+-			user = host = NULL;
+-			if ((cp = strrchr(s, ',')) != NULL && cp != s) {
+-				o->jump_extra = xstrdup(s);
+-				o->jump_extra[cp - s] = '\0';
+-			}
++		o->jump_user = user;
++		o->jump_host = host;
++		o->jump_port = port;
++		o->proxy_command = xstrdup("none");
++		user = host = NULL; /* transferred */
++		if (orig != NULL && (cp = strrchr(orig, ',')) != NULL) {
++			o->jump_extra = xstrdup(orig);
++			o->jump_extra[cp - orig] = '\0';
+ 		}
+ 	}
+ 	ret = 0;
+  out:
+ 	free(orig);
++	free(sdup);
++	free(tmp_user);
++	free(tmp_host);
+ 	free(user);
+ 	free(host);
+ 	return ret;
+diff --color -ruNp a/readconf.h b/readconf.h
+--- a/readconf.h	2026-04-10 15:42:50.470697714 +0200
++++ b/readconf.h	2026-04-10 15:49:57.442110306 +0200
+@@ -249,7 +249,9 @@ int	 process_config_line(Options *, stru
+ int	 read_config_file(const char *, struct passwd *, const char *,
+     const char *, Options *, int, int *);
+ int	 parse_forward(struct Forward *, const char *, int, int);
+-int	 parse_jump(const char *, Options *, int);
++int	 ssh_valid_hostname(const char *);
++int	 ssh_valid_ruser(const char *);
++int	 parse_jump(const char *, Options *, int, int);
+ int	 parse_ssh_uri(const char *, char **, char **, int *);
+ int	 default_ssh_port(void);
+ int	 option_clear_or_none(const char *);
+diff --color -ruNp a/regress/Makefile b/regress/Makefile
+--- a/regress/Makefile	2026-04-10 15:42:50.533815702 +0200
++++ b/regress/Makefile	2026-04-10 16:07:30.566094450 +0200
+@@ -111,7 +111,8 @@ LTESTS= 	connect \
+ 		agent-pkcs11-restrict \
+ 		agent-pkcs11-cert \
+ 		penalty \
+-		penalty-expire
++		penalty-expire \
++		proxyjump
+ 
+ INTEROP_TESTS=	putty-transfer putty-ciphers putty-kex conch-ciphers
+ INTEROP_TESTS+=	dropbear-ciphers dropbear-kex
+diff --color -ruNp a/regress/proxyjump.sh b/regress/proxyjump.sh
+--- a/regress/proxyjump.sh	1970-01-01 01:00:00.000000000 +0100
++++ b/regress/proxyjump.sh	2026-04-10 16:07:55.225958206 +0200
+@@ -0,0 +1,102 @@
++#	$OpenBSD: proxyjump.sh,v 1.1 2026/03/30 07:19:02 djm Exp $
++#	Placed in the Public Domain.
++
++tid="proxyjump"
++
++# Parsing tests
++verbose "basic parsing"
++for jspec in \
++	"jump1" \
++	"user@jump1" \
++	"jump1:2222" \
++	"user@jump1:2222" \
++	"jump1,jump2" \
++	"user1@jump1:2221,user2@jump2:2222" \
++	"ssh://user@host:2223" \
++	; do
++	case "$jspec" in
++	"jump1")		expected="jump1" ;;
++	"user@jump1")		expected="user@jump1" ;;
++	"jump1:2222")		expected="jump1:2222" ;;
++	"user@jump1:2222")	expected="user@jump1:2222" ;;
++	"jump1,jump2")		expected="jump1,jump2" ;;
++	"user1@jump1:2221,user2@jump2:2222")
++		expected="user1@jump1:2221,user2@jump2:2222" ;;
++	"ssh://user@host:2223")	expected="user@host:2223" ;;
++	esac
++	f=`${SSH} -GF /dev/null -oProxyJump="$jspec" somehost | \
++		awk '/^proxyjump /{print $2}'`
++	if [ "$f" != "$expected" ]; then
++		fail "ProxyJump $jspec: expected $expected, got $f"
++	fi
++	f=`${SSH} -GF /dev/null -J "$jspec" somehost | \
++		awk '/^proxyjump /{print $2}'`
++	if [ "$f" != "$expected" ]; then
++		fail "ssh -J $jspec: expected $expected, got $f"
++	fi
++done
++
++verbose "precedence"
++f=`${SSH} -GF /dev/null -oProxyJump=none -oProxyJump=jump1 somehost | \
++	grep "^proxyjump "`
++if [ -n "$f" ]; then
++	fail "ProxyJump=none first did not win"
++fi
++f=`${SSH} -GF /dev/null -oProxyJump=jump -oProxyCommand=foo somehost | \
++	grep "^proxyjump "`
++if [ "$f" != "proxyjump jump" ]; then
++	fail "ProxyJump first did not win over ProxyCommand"
++fi
++f=`${SSH} -GF /dev/null -oProxyCommand=foo -oProxyJump=jump somehost | \
++	grep "^proxycommand "`
++if [ "$f" != "proxycommand foo" ]; then
++	fail "ProxyCommand first did not win over ProxyJump"
++fi
++
++verbose "command-line -J invalid characters"
++cp $OBJ/ssh_config $OBJ/ssh_config.orig
++for jspec in \
++	"host;with;semicolon" \
++	"host'with'quote" \
++	"host\`with\`backtick" \
++	"host\$with\$dollar" \
++	"host(with)brace" \
++	"user;with;semicolon@host" \
++	"user'with'quote@host" \
++	"user\`with\`backtick@host" \
++	"user(with)brace@host" ; do
++	${SSH} -GF /dev/null -J "$jspec" somehost >/dev/null 2>&1
++	if [ $? -ne 255 ]; then
++		fail "ssh -J \"$jspec\" was not rejected"
++	fi
++	${SSH} -GF /dev/null -oProxyJump="$jspec" somehost >/dev/null 2>&1
++	if [ $? -ne 255 ]; then
++		fail "ssh -oProxyJump=\"$jspec\" was not rejected"
++	fi
++done
++# Special characters should be accepted in the config though.
++echo "ProxyJump user;with;semicolon@host;with;semicolon" >> $OBJ/ssh_config
++f=`${SSH} -GF $OBJ/ssh_config somehost | grep "^proxyjump "`
++if [ "$f" != "proxyjump user;with;semicolon@host;with;semicolon" ]; then
++	fail "ProxyJump did not allow special characters in config: $f"
++fi
++
++verbose "functional test"
++# Use different names to avoid the loop detection in ssh.c
++grep -iv HostKeyAlias $OBJ/ssh_config.orig > $OBJ/ssh_config
++cat << _EOF >> $OBJ/ssh_config
++Host jump-host
++	HostkeyAlias jump-host
++Host target-host
++	HostkeyAlias target-host
++_EOF
++cp $OBJ/known_hosts $OBJ/known_hosts.orig
++sed 's/^[^ ]* /jump-host /' < $OBJ/known_hosts.orig > $OBJ/known_hosts
++sed 's/^[^ ]* /target-host /' < $OBJ/known_hosts.orig >> $OBJ/known_hosts
++start_sshd
++
++verbose "functional ProxyJump"
++res=`${REAL_SSH} -F $OBJ/ssh_config -J jump-host target-host echo "SUCCESS" 2>/dev/null`
++if [ "$res" != "SUCCESS" ]; then
++	fail "functional test failed: expected SUCCESS, got $res"
++fi
+diff --color -ruNp a/ssh.c b/ssh.c
+--- a/ssh.c	2026-04-10 15:42:50.657913189 +0200
++++ b/ssh.c	2026-04-10 16:04:07.489047966 +0200
+@@ -639,43 +639,6 @@ ssh_conn_info_free(struct ssh_conn_info
+ 	free(cinfo);
+ }
+ 
+-static int
+-valid_hostname(const char *s)
+-{
+-	size_t i;
+-
+-	if (*s == '-')
+-		return 0;
+-	for (i = 0; s[i] != 0; i++) {
+-		if (strchr("'`\"$\\;&<>|(){}", s[i]) != NULL ||
+-		    isspace((u_char)s[i]) || iscntrl((u_char)s[i]))
+-			return 0;
+-	}
+-	return 1;
+-}
+-
+-static int
+-valid_ruser(const char *s)
+-{
+-	size_t i;
+-
+-	if (*s == '-')
+-		return 0;
+-	for (i = 0; s[i] != 0; i++) {
+-		if (iscntrl((u_char)s[i]))
+-			return 0;
+-		if (strchr("'`\";&<>|(){}", s[i]) != NULL)
+-			return 0;
+-		/* Disallow '-' after whitespace */
+-		if (isspace((u_char)s[i]) && s[i + 1] == '-')
+-			return 0;
+-		/* Disallow \ in last position */
+-		if (s[i] == '\\' && s[i + 1] == '\0')
+-			return 0;
+-	}
+-	return 1;
+-}
+-
+ /*
+  * Main program for the ssh client.
+  */
+@@ -931,9 +894,9 @@ main(int ac, char **av)
+ 			}
+ 			if (options.proxy_command != NULL)
+ 				fatal("Cannot specify -J with ProxyCommand");
+-			if (parse_jump(optarg, &options, 1) == -1)
++			if (parse_jump(optarg, &options, 1, 1) == -1)
++
+ 				fatal("Invalid -J argument");
+-			options.proxy_command = xstrdup("none");
+ 			break;
+ 		case 't':
+ 			if (options.request_tty == REQUEST_TTY_YES)
+@@ -1183,10 +1146,15 @@ main(int ac, char **av)
+ 	if (!host)
+ 		usage();
+ 
+-	if (!valid_hostname(host))
+-		fatal("hostname contains invalid characters");
+-	if (options.user != NULL && !valid_ruser(options.user))
++	/*
++	 * Validate commandline-specified values that end up in %tokens
++	 * before they are used in config parsing.
++	 */
++	if (options.user != NULL && !ssh_valid_ruser(options.user))
+ 		fatal("remote username contains invalid characters");
++	if (!ssh_valid_hostname(host))
++		fatal("hostname contains invalid characters");
++
+ 	options.host_arg = xstrdup(host);
+ 
+ 	/* Initialize the command to execute on remote host. */
+@@ -1347,7 +1315,8 @@ main(int ac, char **av)
+ 			sshbin = "ssh";
+ 
+ 		/* Consistency check */
+-		if (options.proxy_command != NULL)
++		if (options.proxy_command != NULL &&
++		    strcasecmp(options.proxy_command, "none") != 0)
+ 			fatal("inconsistent options: ProxyCommand+ProxyJump");
+ 		/* Never use FD passing for ProxyJump */
+ 		options.proxy_use_fdpass = 0;
+@@ -1467,7 +1436,7 @@ main(int ac, char **av)
+ 	cinfo->jmphost = xstrdup(options.jump_host == NULL ?
+ 	    "" : options.jump_host);
+ 
+-	if (user_on_commandline && !valid_ruser(options.user))
++	if (user_on_commandline && !ssh_valid_ruser(options.user))
+ 		fatal("remote username contains invalid characters");
+ 
+ 	cinfo->conn_hash_hex = ssh_connection_hash(cinfo->thishost,
diff --git a/SOURCES/openssh-9.9p1-scp-clear-setuid.patch b/SOURCES/openssh-9.9p1-scp-clear-setuid.patch
new file mode 100644
index 0000000..1a848a1
--- /dev/null
+++ b/SOURCES/openssh-9.9p1-scp-clear-setuid.patch
@@ -0,0 +1,15 @@
+diff --color -ruNp a/scp.c b/scp.c
+--- a/scp.c	2026-04-07 15:54:11.193730842 +0200
++++ b/scp.c	2026-04-07 15:55:52.529425481 +0200
+@@ -1705,8 +1705,10 @@ sink(int argc, char **argv, const char *
+ 
+ 	setimes = targisdir = 0;
+ 	mask = umask(0);
+-	if (!pflag)
++	if (!pflag) {
++		mask |= 07000;
+ 		(void) umask(mask);
++	}
+ 	if (argc != 1) {
+ 		run_err("ambiguous target");
+ 		exit(1);
diff --git a/SOURCES/openssh-9.9p1-scp-remote-glob.patch b/SOURCES/openssh-9.9p1-scp-remote-glob.patch
new file mode 100644
index 0000000..c08101e
--- /dev/null
+++ b/SOURCES/openssh-9.9p1-scp-remote-glob.patch
@@ -0,0 +1,14 @@
+diff --color -ruNp a/scp.c b/scp.c
+--- a/scp.c	2026-07-14 11:40:47.754600847 +0200
++++ b/scp.c	2026-07-14 11:43:04.077524517 +0200
+@@ -2070,6 +2070,10 @@ throughlocal_sftp(struct sftp_conn *from
+ 			goto out;
+ 		}
+ 
++		/* Special handling for source of '..' */
++		if (strcmp(filename, "..") == 0)
++			filename = "."; /* Download to dest, not dest/.. */
++
+ 		if (targetisdir)
+ 			abs_dst = sftp_path_append(target, filename);
+ 		else
diff --git a/SOURCES/openssh-9.9p1-support-authentication-indicators-in-GSSAPI.patch b/SOURCES/openssh-9.9p1-support-authentication-indicators-in-GSSAPI.patch
index 237e45d..2a74740 100644
--- a/SOURCES/openssh-9.9p1-support-authentication-indicators-in-GSSAPI.patch
+++ b/SOURCES/openssh-9.9p1-support-authentication-indicators-in-GSSAPI.patch
@@ -1,38 +1,7 @@
-From 5d5a66e96ad03132f65371070f4fa475f10207d9 Mon Sep 17 00:00:00 2001
-From: Alexander Bokovoy <abokovoy@redhat.com>
-Date: Mon, 10 Jun 2024 23:00:03 +0300
-Subject: [PATCH] support authentication indicators in GSSAPI
-
-RFC 6680 defines a set of GSSAPI extensions to handle attributes
-associated with the GSSAPI names. MIT Kerberos and FreeIPA use
-name attributes to add information about pre-authentication methods used
-to acquire the initial Kerberos ticket. The attribute 'auth-indicators'
-may contain list of strings that KDC has associated with the ticket
-issuance process.
-
-Use authentication indicators to authorise or deny access to SSH server.
-GSSAPIIndicators setting allows to specify a list of possible indicators
-that a Kerberos ticket presented must or must not contain. More details
-on the syntax are provided in sshd_config(5) man page.
-
-Fixes: https://bugzilla.mindrot.org/show_bug.cgi?id=2696
-
-Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
----
- configure.ac    |   1 +
- gss-serv-krb5.c |  64 +++++++++++++++++++++++++++---
- gss-serv.c      | 103 +++++++++++++++++++++++++++++++++++++++++++++++-
- servconf.c      |  15 ++++++-
- servconf.h      |   2 +
- ssh-gss.h       |   7 ++++
- sshd_config.5   |  44 +++++++++++++++++++++
- 7 files changed, 228 insertions(+), 8 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index d92a85809..2cbe20bf3 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -5004,6 +5004,7 @@ AC_ARG_WITH([kerberos5],
+diff --color -ruNp a/configure.ac b/configure.ac
+--- a/configure.ac	2026-03-10 12:43:36.860784813 +0100
++++ b/configure.ac	2026-03-10 12:46:27.022297835 +0100
+@@ -4932,6 +4932,7 @@ AC_ARG_WITH([kerberos5],
  		AC_CHECK_HEADERS([gssapi.h gssapi/gssapi.h])
  		AC_CHECK_HEADERS([gssapi_krb5.h gssapi/gssapi_krb5.h])
  		AC_CHECK_HEADERS([gssapi_generic.h gssapi/gssapi_generic.h])
@@ -40,10 +9,159 @@ index d92a85809..2cbe20bf3 100644
  
  		AC_SEARCH_LIBS([k_hasafs], [kafs], [AC_DEFINE([USE_AFS], [1],
  			[Define this if you want to use libkafs' AFS support])])
-diff --git a/gss-serv-krb5.c b/gss-serv-krb5.c
-index 03188d9b3..2c786ef14 100644
---- a/gss-serv-krb5.c
-+++ b/gss-serv-krb5.c
+diff --color -ruNp a/gss-serv.c b/gss-serv.c
+--- a/gss-serv.c	2026-06-16 15:38:26.590728235 +0200
++++ b/gss-serv.c	2026-06-16 15:41:13.717696103 +0200
+@@ -53,7 +53,7 @@ extern ServerOptions options;
+ 
+ static ssh_gssapi_client gssapi_client =
+     { GSS_C_EMPTY_BUFFER, GSS_C_EMPTY_BUFFER, GSS_C_NO_CREDENTIAL,
+-    GSS_C_NO_NAME, NULL, {NULL, NULL, NULL, NULL, NULL}, 0, 0};
++    GSS_C_NO_NAME, NULL, {NULL, NULL, NULL, NULL, NULL}, 0, 0, NULL};
+ 
+ ssh_gssapi_mech gssapi_null_mech =
+     { NULL, NULL, {0, NULL}, NULL, NULL, NULL, NULL, NULL};
+@@ -295,6 +295,99 @@ ssh_gssapi_parse_ename(Gssctxt *ctx, gss
+ 	return GSS_S_COMPLETE;
+ }
+ 
++
++/* Extract authentication indicators from the Kerberos ticket. Authentication
++ * indicators are GSSAPI name attributes for the name "auth-indicators".
++ * Multiple indicators might be present in the ticket.
++ * Each indicator is an utf8 string. */
++
++#define AUTH_INDICATORS_TAG "auth-indicators"
++#define SSH_GSSAPI_MAX_INDICATORS 64
++
++/* Privileged (called from accept_secure_ctx) */
++static OM_uint32
++ssh_gssapi_getindicators(Gssctxt *ctx, gss_name_t gss_name, ssh_gssapi_client *client)
++{
++	gss_buffer_set_t attrs = GSS_C_NO_BUFFER_SET;
++	gss_buffer_desc value = GSS_C_EMPTY_BUFFER;
++	gss_buffer_desc display_value = GSS_C_EMPTY_BUFFER;
++	int is_mechname, authenticated, complete, more;
++	size_t count, i;
++
++	/* always initialize client->indicators */
++	client->indicators = NULL;
++
++	ctx->major = gss_inquire_name(&ctx->minor, gss_name,
++				      &is_mechname, NULL, &attrs);
++	if (ctx->major != GSS_S_COMPLETE)
++		return ctx->major;
++
++	if (attrs == GSS_C_NO_BUFFER_SET) {
++		/* no indicators in the ticket */
++		return GSS_S_COMPLETE;
++	}
++
++	/* client->indicators is NULL terminated */
++	count = 0;
++	client->indicators = xcalloc(count + 1, sizeof(char *));
++
++	for (i = 0; i < attrs->count; i++) {
++		authenticated = 0;
++		complete = 0;
++		more = -1;
++
++		/* skip anything but auth-indicators */
++		if (((sizeof(AUTH_INDICATORS_TAG) - 1) != attrs->elements[i].length) ||
++		    memcmp(AUTH_INDICATORS_TAG, attrs->elements[i].value,
++			   sizeof(AUTH_INDICATORS_TAG) - 1) != 0)
++			continue;
++
++		/* retrieve all indicators */
++		while (more != 0) {
++			value.value = NULL;
++			display_value.value = NULL;
++
++			ctx->major = gss_get_name_attribute(&ctx->minor, gss_name,
++							    &attrs->elements[i],
++							    &authenticated, &complete,
++							    &value, &display_value, &more);
++			if (ctx->major != GSS_S_COMPLETE)
++				goto out;
++
++			if (value.value == NULL || !authenticated)
++				continue;
++
++			if (count >= SSH_GSSAPI_MAX_INDICATORS) {
++				logit("ssh_gssapi_getindicators:"
++				      " too many indicators, truncating at %d",
++				      SSH_GSSAPI_MAX_INDICATORS);
++				goto out;
++			}
++
++			client->indicators[count] = xmalloc(value.length + 1);
++			memcpy(client->indicators[count], value.value, value.length);
++			client->indicators[count][value.length] = '\0';
++			count++;
++
++			/* add NULL terminator */
++			client->indicators = xrecallocarray(client->indicators, count,
++							    count + 1, sizeof(char *));
++		}
++	}
++
++out:
++	if (ctx->major != GSS_S_COMPLETE && client->indicators != NULL) {
++		for (i = 0; i < count; i++)
++			free(client->indicators[i]);
++		free(client->indicators);
++		client->indicators = NULL;
++	}
++	gss_release_buffer(&ctx->minor, &value);
++	gss_release_buffer(&ctx->minor, &display_value);
++	gss_release_buffer_set(&ctx->minor, &attrs);
++	return ctx->major;
++}
++
+ /* Extract the client details from a given context. This can only reliably
+  * be called once for a context */
+ 
+@@ -384,6 +477,12 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_g
+ 	}
+ 
+ 	gss_release_buffer(&ctx->minor, &ename);
++	/* Retrieve authentication indicators, if they exist */
++	if ((ctx->major = ssh_gssapi_getindicators(ctx,
++	    ctx->client, client))) {
++		ssh_gssapi_error(ctx);
++		return (ctx->major);
++	}
+ 
+ 	/* We can't copy this structure, so we just move the pointer to it */
+ 	client->creds = ctx->client_creds;
+@@ -446,6 +545,7 @@ int
+ ssh_gssapi_userok(char *user, struct passwd *pw, int kex)
+ {
+ 	OM_uint32 lmin;
++	size_t i;
+ 
+ 	(void) kex; /* used in privilege separation */
+ 
+@@ -464,8 +564,14 @@ ssh_gssapi_userok(char *user, struct pas
+ 			gss_release_buffer(&lmin, &gssapi_client.displayname);
+ 			gss_release_buffer(&lmin, &gssapi_client.exportedname);
+ 			gss_release_cred(&lmin, &gssapi_client.creds);
+-			explicit_bzero(&gssapi_client,
+-			    sizeof(ssh_gssapi_client));
++
++			if (gssapi_client.indicators != NULL) {
++				for (i = 0; gssapi_client.indicators[i] != NULL; i++)
++					free(gssapi_client.indicators[i]);
++				free(gssapi_client.indicators);
++			}
++
++			explicit_bzero(&gssapi_client, sizeof(ssh_gssapi_client));
+ 			return 0;
+ 		}
+ 	else
+diff --color -ruNp a/gss-serv-krb5.c b/gss-serv-krb5.c
+--- a/gss-serv-krb5.c	2026-03-10 12:43:36.823015336 +0100
++++ b/gss-serv-krb5.c	2026-03-11 12:58:56.024455238 +0100
 @@ -43,6 +43,7 @@
  #include "log.h"
  #include "misc.h"
@@ -52,7 +170,7 @@ index 03188d9b3..2c786ef14 100644
  
  #include "ssh-gss.h"
  
-@@ -87,6 +88,32 @@ ssh_gssapi_krb5_init(void)
+@@ -87,6 +88,33 @@ ssh_gssapi_krb5_init(void)
  	return 1;
  }
  
@@ -67,6 +185,7 @@ index 03188d9b3..2c786ef14 100644
 +{
 +	int ret;
 +	u_int i;
++	*matched = -1;
 +
 +	/* Check indicators */
 +	for (i = 0; client->indicators[i] != NULL; i++) {
@@ -85,218 +204,112 @@ index 03188d9b3..2c786ef14 100644
  /* Check if this user is OK to login. This only works with krb5 - other
   * GSSAPI mechanisms will need their own.
   * Returns true if the user is OK to log in, otherwise returns 0
-@@ -193,7 +220,7 @@ static int
+@@ -193,15 +221,15 @@ static int
  ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name)
  {
  	krb5_principal princ;
 -	int retval;
-+	int retval, matched;
++	int retval, matched, success;
  	const char *errmsg;
  	int k5login_exists;
  
-@@ -216,17 +243,42 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name)
+ 	if (ssh_gssapi_krb5_init() == 0)
+ 		return 0;
+ 
+-	if ((retval = krb5_parse_name(krb_context, client->exportedname.value,
+-	    &princ))) {
++	retval = krb5_parse_name(krb_context, client->exportedname.value, &princ);
++	if (retval) {
+ 		errmsg = krb5_get_error_message(krb_context, retval);
+ 		logit("krb5_parse_name(): %.100s", errmsg);
+ 		krb5_free_error_message(krb_context, errmsg);
+@@ -216,17 +244,60 @@ ssh_gssapi_krb5_userok(ssh_gssapi_client
  	if (k5login_exists &&
  	    ssh_krb5_kuserok(krb_context, princ, name, k5login_exists)) {
  		retval = 1;
 -		logit("Authorized to %s, krb5 principal %s (krb5_kuserok)",
 -		    name, (char *)client->displayname.value);
-+	    errmsg = "krb5_kuserok";
++		errmsg = "krb5_kuserok";
  	} else if (ssh_gssapi_krb5_cmdok(princ, client->exportedname.value,
  		name, k5login_exists)) {
  		retval = 1;
 -		logit("Authorized to %s, krb5 principal %s "
 -		    "(ssh_gssapi_krb5_cmdok)",
 -		    name, (char *)client->displayname.value);
+-	} else
 +		errmsg = "ssh_gssapi_krb5_cmdok";
- 	} else
- 		retval = 0;
- 
-+	if ((retval == 1) && (options.gss_indicators != NULL)) {
-+		/* At this point the configuration enforces presence of indicators
-+		 * so we drop the authorization result again */
++	} else {
 +		retval = 0;
-+		if (client->indicators) {
-+			matched = -1;
-+			retval = ssh_gssapi_check_indicators(client, &matched);
-+			if (retval != 0) {
-+				retval = (retval == 1);
-+				logit("Ticket contains indicator %s, "
-+					"krb5 principal %s is %s",
-+					client->indicators[matched],
-+					(char *)client->displayname.value,
-+				        retval ? "allowed" : "denied");
-+				goto cont;
-+			}
-+		}
-+		if (retval == 0) {
-+			logit("GSSAPI authentication indicators enforced "
-+				"but not matched. krb5 principal %s denied",
-+			(char *)client->displayname.value);
-+		}
++		goto out;
 +	}
-+cont:
++
++	/* At this point we are good if no indicators were defined */
++	if (options.gss_indicators == NULL) {
++		retval = 1;
++		goto out;
++	}
++
++	/* At this point we have indicators defined in the configuration,
++	 * if clientt did not provide any indicators, we reject */
++	if (!client->indicators) {
++		retval = 0;
++		logit("GSSAPI authentication indicators enforced "
++		      "but indicators not provided by the client. "
++		      "krb5 principal %s denied",
++		      (char *)client->displayname.value);
++		goto out;
++	}
++
++	/* At this point the configuration enforces presence of indicators
++	 * check the match */
++	matched = -1;
++	success = ssh_gssapi_check_indicators(client, &matched);
++
++	switch (success) {
++	case 1:
++		logit("Provided indicator %s allowed by the configuration",
++		      client->indicators[matched]);
++		retval = 1;
++		break;
++	case -1:
++		logit("Provided indicator %s rejected by the configuration",
++		      client->indicators[matched]);
++		retval = 0;
++		break;
++	default:
++		logit("Provided indicators do not match the configuration");
+ 		retval = 0;
++		break;
++	}
+ 
++out:
 +	if (retval == 1) {
 +		logit("Authorized to %s, krb5 principal %s (%s)",
-+		    name, (char *)client->displayname.value, errmsg);
++		      name, (char *)client->displayname.value, errmsg);
 +	}
  	krb5_free_principal(krb_context, princ);
  	return retval;
  }
-diff --git a/gss-serv.c b/gss-serv.c
-index 9d5435eda..5c0491cf1 100644
---- a/gss-serv.c
-+++ b/gss-serv.c
-@@ -54,7 +54,7 @@ extern ServerOptions options;
- 
- static ssh_gssapi_client gssapi_client =
-     { GSS_C_EMPTY_BUFFER, GSS_C_EMPTY_BUFFER, GSS_C_NO_CREDENTIAL,
--    GSS_C_NO_NAME, NULL, {NULL, NULL, NULL, NULL, NULL}, 0, 0};
-+    GSS_C_NO_NAME, NULL, {NULL, NULL, NULL, NULL, NULL}, 0, 0, NULL};
- 
- ssh_gssapi_mech gssapi_null_mech =
-     { NULL, NULL, {0, NULL}, NULL, NULL, NULL, NULL, NULL};
-@@ -296,6 +296,92 @@ ssh_gssapi_parse_ename(Gssctxt *ctx, gss_buffer_t ename, gss_buffer_t name)
- 	return GSS_S_COMPLETE;
- }
- 
-+
-+/* Extract authentication indicators from the Kerberos ticket. Authentication
-+ * indicators are GSSAPI name attributes for the name "auth-indicators".
-+ * Multiple indicators might be present in the ticket.
-+ * Each indicator is a utf8 string. */
-+
-+#define AUTH_INDICATORS_TAG "auth-indicators"
-+
-+/* Privileged (called from accept_secure_ctx) */
-+static OM_uint32
-+ssh_gssapi_getindicators(Gssctxt *ctx, gss_name_t gss_name, ssh_gssapi_client *client)
-+{
-+	gss_buffer_set_t attrs = GSS_C_NO_BUFFER_SET;
-+	gss_buffer_desc value = GSS_C_EMPTY_BUFFER;
-+	gss_buffer_desc display_value = GSS_C_EMPTY_BUFFER;
-+	int is_mechname, authenticated, complete, more;
-+	size_t count, i;
-+
-+	ctx->major = gss_inquire_name(&ctx->minor, gss_name,
-+				      &is_mechname, NULL, &attrs);
-+	if (ctx->major != GSS_S_COMPLETE) {
-+		return (ctx->major);
-+	}
-+
-+	if (attrs == GSS_C_NO_BUFFER_SET) {
-+		/* No indicators in the ticket */
-+		return (0);
-+	}
-+
-+	count = 0;
-+	for (i = 0; i < attrs->count; i++) {
-+		/* skip anything but auth-indicators */
-+		if (((sizeof(AUTH_INDICATORS_TAG) - 1) != attrs->elements[i].length) ||
-+		    strncmp(AUTH_INDICATORS_TAG,
-+			    attrs->elements[i].value,
-+			    sizeof(AUTH_INDICATORS_TAG) - 1) != 0)
-+			continue;
-+		count++;
-+	}
-+
-+	if (count == 0) {
-+		/* No auth-indicators in the ticket */
-+		(void) gss_release_buffer_set(&ctx->minor, &attrs);
-+		return (0);
-+	}
-+
-+	client->indicators = recallocarray(NULL, 0, count + 1, sizeof(char*));
-+	count = 0;
-+	for (i = 0; i < attrs->count; i++) {
-+		authenticated = 0;
-+		complete = 0;
-+		more = -1;
-+		/* skip anything but auth-indicators */
-+		if (((sizeof(AUTH_INDICATORS_TAG) - 1) != attrs->elements[i].length) ||
-+		    strncmp(AUTH_INDICATORS_TAG,
-+			    attrs->elements[i].value,
-+			    sizeof(AUTH_INDICATORS_TAG) - 1) != 0)
-+			continue;
-+		/* retrieve all indicators */
-+		while (more != 0) {
-+			value.value = NULL;
-+			display_value.value = NULL;
-+			ctx->major = gss_get_name_attribute(&ctx->minor, gss_name,
-+					&attrs->elements[i], &authenticated,
-+					&complete, &value, &display_value, &more);
-+			if (ctx->major != GSS_S_COMPLETE) {
-+				goto out;
-+			}
-+
-+			if ((value.value != NULL) && authenticated) {
-+				client->indicators[count] = xmalloc(value.length + 1);
-+				memcpy(client->indicators[count], value.value, value.length);
-+				client->indicators[count][value.length] = '\0';
-+				count++;
-+			}
-+		}
-+	}
-+
-+out:
-+	(void) gss_release_buffer(&ctx->minor, &value);
-+	(void) gss_release_buffer(&ctx->minor, &display_value);
-+	(void) gss_release_buffer_set(&ctx->minor, &attrs);
-+	return (ctx->major);
-+}
-+
-+
- /* Extract the client details from a given context. This can only reliably
-  * be called once for a context */
- 
-@@ -385,6 +471,12 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client)
- 	}
- 
- 	gss_release_buffer(&ctx->minor, &ename);
-+	/* Retrieve authentication indicators, if they exist */
-+	if ((ctx->major = ssh_gssapi_getindicators(ctx,
-+	    ctx->client, client))) {
-+		ssh_gssapi_error(ctx);
-+		return (ctx->major);
-+	}
- 
- 	/* We can't copy this structure, so we just move the pointer to it */
- 	client->creds = ctx->client_creds;
-@@ -447,6 +539,7 @@ int
- ssh_gssapi_userok(char *user, struct passwd *pw, int kex)
- {
- 	OM_uint32 lmin;
-+	size_t i;
- 
- 	(void) kex; /* used in privilege separation */
- 
-@@ -465,6 +558,14 @@ ssh_gssapi_userok(char *user, struct passwd *pw, int kex)
- 			gss_release_buffer(&lmin, &gssapi_client.displayname);
- 			gss_release_buffer(&lmin, &gssapi_client.exportedname);
- 			gss_release_cred(&lmin, &gssapi_client.creds);
-+
-+			if (gssapi_client.indicators != NULL) {
-+				for(i = 0; gssapi_client.indicators[i] != NULL; i++) {
-+					free(gssapi_client.indicators[i]);
-+				}
-+				free(gssapi_client.indicators);
-+			}
-+
- 			explicit_bzero(&gssapi_client,
- 			    sizeof(ssh_gssapi_client));
- 			return 0;
-diff --git a/servconf.c b/servconf.c
-index e7e4ad046..aab653244 100644
---- a/servconf.c
-+++ b/servconf.c
-@@ -147,6 +147,7 @@ initialize_server_options(ServerOptions *options)
+diff --color -ruNp a/servconf.c b/servconf.c
+--- a/servconf.c	2026-03-10 12:43:36.928060353 +0100
++++ b/servconf.c	2026-03-11 13:20:09.725354925 +0100
+@@ -144,6 +144,7 @@ initialize_server_options(ServerOptions
+ 	options->gss_keyex = -1;
+ 	options->gss_cleanup_creds = -1;
  	options->gss_strict_acceptor = -1;
++	options->gss_indicators = NULL;
  	options->gss_store_rekey = -1;
  	options->gss_kex_algorithms = NULL;
-+	options->gss_indicators = NULL;
  	options->use_kuserok = -1;
- 	options->enable_k5users = -1;
- 	options->password_authentication = -1;
-@@ -598,7 +599,7 @@ typedef enum {
+@@ -557,6 +558,7 @@ fill_default_server_options(ServerOption
+ 	CLEAR_ON_NONE(options->routing_domain);
+ 	CLEAR_ON_NONE(options->host_key_agent);
+ 	CLEAR_ON_NONE(options->per_source_penalty_exempt);
++	CLEAR_ON_NONE(options->gss_indicators);
+ 
+ 	for (i = 0; i < options->num_host_key_files; i++)
+ 		CLEAR_ON_NONE(options->host_key_files[i]);
+@@ -594,7 +596,7 @@ typedef enum {
  	sPerSourcePenalties, sPerSourcePenaltyExemptList,
  	sClientAliveInterval, sClientAliveCountMax, sAuthorizedKeysFile,
  	sGssAuthentication, sGssCleanupCreds, sGssEnablek5users, sGssStrictAcceptor,
@@ -305,7 +318,7 @@ index e7e4ad046..aab653244 100644
  	sAcceptEnv, sSetEnv, sPermitTunnel,
  	sMatch, sPermitOpen, sPermitListen, sForceCommand, sChrootDirectory,
  	sUsePrivilegeSeparation, sAllowAgentForwarding,
-@@ -694,6 +695,7 @@ static struct {
+@@ -690,6 +692,7 @@ static struct {
  	{ "gssapistorecredentialsonrekey", sGssStoreRekey, SSHCFG_GLOBAL },
  	{ "gssapikexalgorithms", sGssKexAlgorithms, SSHCFG_GLOBAL },
  	{ "gssapienablek5users", sGssEnablek5users, SSHCFG_ALL },
@@ -313,7 +326,7 @@ index e7e4ad046..aab653244 100644
  #else
  	{ "gssapiauthentication", sUnsupported, SSHCFG_ALL },
  	{ "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL },
-@@ -703,6 +705,7 @@ static struct {
+@@ -699,6 +702,7 @@ static struct {
  	{ "gssapistorecredentialsonrekey", sUnsupported, SSHCFG_GLOBAL },
  	{ "gssapikexalgorithms", sUnsupported, SSHCFG_GLOBAL },
  	{ "gssapienablek5users", sUnsupported, SSHCFG_ALL },
@@ -321,7 +334,7 @@ index e7e4ad046..aab653244 100644
  #endif
  	{ "gssusesessionccache", sUnsupported, SSHCFG_GLOBAL },
  	{ "gssapiusesessioncredcache", sUnsupported, SSHCFG_GLOBAL },
-@@ -1730,6 +1733,15 @@ process_server_config_line_depth(ServerOptions *options, char *line,
+@@ -1715,6 +1719,15 @@ process_server_config_line_depth(ServerO
  			options->gss_kex_algorithms = xstrdup(arg);
  		break;
  
@@ -337,7 +350,7 @@ index e7e4ad046..aab653244 100644
  	case sPasswordAuthentication:
  		intptr = &options->password_authentication;
  		goto parse_flag;
-@@ -3351,6 +3363,7 @@ dump_config(ServerOptions *o)
+@@ -3329,6 +3342,7 @@ dump_config(ServerOptions *o)
  	dump_cfg_fmtint(sGssStrictAcceptor, o->gss_strict_acceptor);
  	dump_cfg_fmtint(sGssStoreRekey, o->gss_store_rekey);
  	dump_cfg_string(sGssKexAlgorithms, o->gss_kex_algorithms);
@@ -345,10 +358,9 @@ index e7e4ad046..aab653244 100644
  #endif
  	dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication);
  	dump_cfg_fmtint(sKbdInteractiveAuthentication,
-diff --git a/servconf.h b/servconf.h
-index 7c7e5d434..7c41df417 100644
---- a/servconf.h
-+++ b/servconf.h
+diff --color -ruNp a/servconf.h b/servconf.h
+--- a/servconf.h	2026-03-10 12:43:36.833119920 +0100
++++ b/servconf.h	2026-03-11 13:21:36.742117033 +0100
 @@ -181,6 +181,7 @@ typedef struct {
  	char   **allow_groups;
  	u_int num_deny_groups;
@@ -357,7 +369,7 @@ index 7c7e5d434..7c41df417 100644
  
  	u_int num_subsystems;
  	char   **subsystem_name;
-@@ -310,6 +311,7 @@ TAILQ_HEAD(include_list, include_item);
+@@ -309,6 +310,7 @@ TAILQ_HEAD(include_list, include_item);
  		M_CP_STROPT(routing_domain); \
  		M_CP_STROPT(permit_user_env_allowlist); \
  		M_CP_STROPT(pam_service_name); \
@@ -365,36 +377,10 @@ index 7c7e5d434..7c41df417 100644
  		M_CP_STRARRAYOPT(authorized_keys_files, num_authkeys_files); \
  		M_CP_STRARRAYOPT(allow_users, num_allow_users); \
  		M_CP_STRARRAYOPT(deny_users, num_deny_users); \
-diff --git a/ssh-gss.h b/ssh-gss.h
-index a894e23c9..59cf46d47 100644
---- a/ssh-gss.h
-+++ b/ssh-gss.h
-@@ -34,6 +34,12 @@
- #include <gssapi/gssapi.h>
- #endif
- 
-+#ifdef HAVE_GSSAPI_EXT_H
-+#include <gssapi_ext.h>
-+#elif defined(HAVE_GSSAPI_GSSAPI_EXT_H)
-+#include <gssapi/gssapi_ext.h>
-+#endif
-+
- #ifdef KRB5
- # ifndef HEIMDAL
- #  ifdef HAVE_GSSAPI_GENERIC_H
-@@ -107,6 +113,7 @@ typedef struct {
- 	ssh_gssapi_ccache store;
- 	int used;
- 	int updated;
-+	char **indicators; /* auth indicators */
- } ssh_gssapi_client;
- 
- typedef struct ssh_gssapi_mech_struct {
-diff --git a/sshd_config.5 b/sshd_config.5
-index 583a01cdb..90ab87edd 100644
---- a/sshd_config.5
-+++ b/sshd_config.5
-@@ -785,6 +785,50 @@ gss-nistp256-sha256-
+diff --color -ruNp a/sshd_config.5 b/sshd_config.5
+--- a/sshd_config.5	2026-03-10 12:43:36.859313302 +0100
++++ b/sshd_config.5	2026-03-11 13:28:04.541970063 +0100
+@@ -785,6 +785,52 @@ gss-nistp256-sha256-
  gss-curve25519-sha256-
  .Ed
  This option only applies to connections using GSSAPI.
@@ -441,10 +427,33 @@ index 583a01cdb..90ab87edd 100644
 +FIDO2-based pre-authentication in FreeIPA, using FIDO2 USB and NFC tokens
 +.El
 +.Pp
-+The default is to not use GSSAPI authentication indicators for access decisions.
++The default
++.Dq none
++is to not use GSSAPI authentication indicators for access decisions.
  .It Cm HostbasedAcceptedAlgorithms
  The default is handled system-wide by
  .Xr crypto-policies 7 .
--- 
-2.49.0
-
+diff --color -ruNp a/ssh-gss.h b/ssh-gss.h
+--- a/ssh-gss.h	2026-03-10 12:43:36.898148309 +0100
++++ b/ssh-gss.h	2026-03-11 13:23:07.601956965 +0100
+@@ -34,6 +34,12 @@
+ #include <gssapi/gssapi.h>
+ #endif
+ 
++#ifdef HAVE_GSSAPI_EXT_H
++#include <gssapi_ext.h>
++#elif defined(HAVE_GSSAPI_GSSAPI_EXT_H)
++#include <gssapi/gssapi_ext.h>
++#endif
++
+ #ifdef KRB5
+ # ifndef HEIMDAL
+ #  ifdef HAVE_GSSAPI_GENERIC_H
+@@ -112,6 +118,7 @@ typedef struct {
+ 	ssh_gssapi_ccache store;
+ 	int used;
+ 	int updated;
++	char **indicators; /* auth indicators */
+ } ssh_gssapi_client;
+ 
+ typedef struct ssh_gssapi_mech_struct {
diff --git a/SOURCES/pam_ssh_agent_auth-0.10.4-doc.patch b/SOURCES/pam_ssh_agent_auth-0.10.4-doc.patch
new file mode 100644
index 0000000..f6f0d05
--- /dev/null
+++ b/SOURCES/pam_ssh_agent_auth-0.10.4-doc.patch
@@ -0,0 +1,11 @@
+diff --color -ruNp a/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/pam_ssh_agent_auth.pod b/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/pam_ssh_agent_auth.pod
+--- a/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/pam_ssh_agent_auth.pod	2019-07-08 18:36:13.000000000 +0200
++++ b/pam_ssh_agent_auth-pam_ssh_agent_auth-0.10.4/pam_ssh_agent_auth.pod	2026-03-17 12:24:44.462364449 +0100
+@@ -18,7 +18,6 @@ This module provides authentication via
+ 
+ =item /etc/sudoers:
+  
+-In older versions of sudo (< 1.8.5) it was necessary to set:
+  Defaults    env_keep += "SSH_AUTH_SOCK"
+ 
+ =back
diff --git a/SPECS/openssh.spec b/SPECS/openssh.spec
index b8bd2c3..f5aca32 100644
--- a/SPECS/openssh.spec
+++ b/SPECS/openssh.spec
@@ -47,9 +47,9 @@
 
 # Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1
 %global openssh_ver 9.9p1
-%global openssh_rel 4
+%global openssh_rel 11
 %global pam_ssh_agent_ver 0.10.4
-%global pam_ssh_agent_rel 7
+%global pam_ssh_agent_rel 9
 
 Summary: An open source implementation of SSH protocol version 2
 Name: openssh
@@ -104,6 +104,8 @@ Patch306: pam_ssh_agent_auth-0.10.2-compat.patch
 Patch307: pam_ssh_agent_auth-0.10.2-dereference.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=2070113
 Patch308: pam_ssh_agent_auth-0.10.4-rsasha2.patch
+# fix manual page claiming SSH_AUTH_SOCK not being required by newer sudo
+Patch309: pam_ssh_agent_auth-0.10.4-doc.patch
 
 #https://bugzilla.mindrot.org/show_bug.cgi?id=1641 (WONTFIX)
 Patch400: openssh-7.8p1-role-mls.patch
@@ -245,6 +247,29 @@ Patch1037: openssh-9.9p1-reject-cntrl-chars-in-username.patch
 # upstream 43b3bff47bb029f2299bacb6a36057981b39fdb0
 Patch1038: openssh-9.9p1-reject-null-char-in-url-string.patch
 Patch1039: openssh-9.9p1-compat-mlkem.patch
+# https://github.com/openssh/openssh-portable/pull/649
+Patch1040: openssh-9.9p1-fill-default-options-error.patch
+# upstream 487e8ac146f7d6616f65c125d5edb210519b833a
+Patch1041: openssh-9.9p1-scp-clear-setuid.patch
+# upstream c805b97b67c774e0bf922ffb29dfbcda9d7b5add
+Patch1042: openssh-9.9p1-mux-askpass-check.patch
+# upstream fd1c7e131f331942d20f42f31e79912d570081fa
+Patch1043: openssh-9.9p1-ecdsa-incomplete-application.patch
+# upstream fd1c7e131f331942d20f42f31e79912d570081fa
+Patch1044: openssh-9.9p1-authorized-keys-principles-option.patch
+# upstream 76685c9b09a66435cd2ad8373246adf1c53976d3
+# upstream 0a0ef4515361143cad21afa072319823854c1cf6
+# upstream 607bd871ec029e9aa22e632a22547250f3cae223
+# upstream 1340d3fa8e4bb122906a82159c4c9b91584d65ce
+Patch1045: openssh-9.9p1-proxyjump-username-validity-checks.patch
+# upstream 36480181fa22f98e180b4f9e10203480c0346c78
+Patch1046: openssh-9.9p1-scp-remote-glob.patch
+# upstream e8bdfb151a356d0171fea4194dd205fbb252be23
+Patch1047: openssh-9.9p1-cve-2026-60002.patch
+# upstream eddd1d2daa64a6ab1a915ca88436fa41aede44d4
+# upstream bc328144f149af07139a0f2c1329018cd85b86b7
+Patch1048: openssh-9.9p1-maxstartups-mistracking.patch
+
 
 License: BSD
 Requires: /sbin/nologin
@@ -380,6 +405,7 @@ pushd pam_ssh_agent_auth-pam_ssh_agent_auth-%{pam_ssh_agent_ver}
 %patch305 -p2 -b .psaa-agent
 %patch307 -p2 -b .psaa-deref
 %patch308 -p2 -b .rsasha2
+%patch309 -p2 -b .psaa-doc
 # Remove duplicate headers and library files
 rm -f $(cat %{SOURCE5})
 popd
@@ -437,9 +463,6 @@ popd
 
 %patch1002 -p1 -b .ssh-manpage
 %patch1006 -p1 -b .negotiate-supported-algs
-
-%patch100 -p1 -b .coverity
-
 %patch1007 -p1 -b .sshrsacheck
 %patch1012 -p1 -b .evp-fips-kex
 %patch1015 -p1 -b .pam-rhost
@@ -460,6 +483,17 @@ popd
 %patch1037 -p1 -b .reject-cntrl-chars-in-username
 %patch1038 -p1 -b .reject-null-char-in-url-string
 %patch1039 -p1 -b .skip-mlkem-when-na
+%patch1040 -p1 -b .fill-default-options-error
+%patch1041 -p1 -b .scp-clear-setuid
+%patch1042 -p1 -b .mux-askpass-check
+%patch1043 -p1 -b .ecdsa-incomplete-application
+%patch1044 -p1 -b .authorized-keys-principles-option
+%patch1045 -p1 -b .proxyjump-username-validity-checks
+%patch1046 -p1 -b .scp-remote-glob
+%patch1047 -p1 -b .cve-2026-60002
+%patch1048 -p1 -b .maxstartups-mistracking
+
+%patch100 -p1 -b .coverity
 
 autoreconf
 pushd pam_ssh_agent_auth-pam_ssh_agent_auth-%{pam_ssh_agent_ver}
@@ -748,9 +782,62 @@ test -f %{sysconfig_anaconda} && \
 %endif
 
 %changelog
-* Mon Mar 30 2026 Koichiro Iwao <meta@almalinux.org> - 9.9p1-4.alma.1
+* Mon Aug 24 2026 Koichiro Iwao <meta@almalinux.org> - 9.9p1-11.alma.1
 - Unpatch Red Hat help message
 
+* Thu Jul 30 2026 Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-11
+- Fix mistracking of MaxStartups process exits in some situations
+  Resolves: RHEL-216650
+
+* Tue Jul 14 2026 Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-10
+- CVE-2026-59996: Fix remote glob result of ".." causing files to be placed
+  in unintended parent directories when scp performs remote-to-remote copy
+  via the local host
+  Resolves: RHEL-193176
+- CVE-2026-60002: Fix use-after-free in cached hostkey during key re-exchange
+  Resolves: RHEL-193023
+
+* Fri Jun 26 2026 Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-9
+- CVE-2026-55653: Fix double free in openssh DH-GEX client path during
+  FIPS known-group validation that leads to client-side denial of service
+  Resolves: RHEL-186440
+- CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator
+  cleanup due to missing NULL terminator
+  Resolves: RHEL-185835
+- CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket
+  pre-binding
+  Resolves: RHEL-185850
+
+* Wed Apr 01 2026 Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-8
+- Fix static analysis issues
+  Resolves: RHEL-163366
+- Ssh should refuse connection when mlkem kex is specified in FIPS
+  Resolves: RHEL-155161
+- CVE-2026-35385: Fix privilege escalation via scp legacy protocol
+  when not in preserving file mode
+  Resolves: RHEL-164754
+- CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode
+  multiplexing sessions
+  Resolves: RHEL-166251
+- CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms
+  and HostbasedAcceptedAlgorithms with regard to ECDSA keys
+  Resolves: RHEL-166235
+- CVE-2026-35414: Fix mishandling of authorized_keys principals option
+  Resolves: RHEL-166203
+- CVE-2026-35386: Add validation rules to usernames and hostnames
+  set for ProxyJump/-J on the commandline
+  Resolves: RHEL-166219
+
+* Thu Mar 26 2026 Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-7 + 0.10.4-9
+- Version bump
+
+* Mon Mar 16 2026 Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-5 + 0.10.4-8
+- CVE-2026-3497: Fix information disclosure or denial of service due
+  to uninitialized variables in gssapi-keyex
+  Resolves: RHEL-155825
+- Fix incorrect claim about SSH_AUTH_SOCK in pam_ssh_agent_auth manual page
+  Resolves: RHEL-122302
+
 * Wed Feb 25 2026 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.9p1-4
 - Provide a way to skip unsupported ML-KEM hybrid algorithms in FIPS mode
   Resolves: RHEL-151580