Dropbear security fix release

ncompact · May 14, 2026, 8:55am

Can we expect a 25.12.4 release with the Dropbear 2026.90 or 2026.91 fix backported ?

github.com/openwrt/openwrt

dropbear: bump to 2026.91 (#23217)

main ← rockdrilla:dropbear-2026.90

aperto 08:16AM - 04 May 26 UTC

rockdrilla

+132 -62

- update dropbear to latest stable **2026.91**; for the changes see https://m…att.ucc.asn.au/dropbear/CHANGES - automatically refresh patches OpenWrt-specific changes: - **build**: - add new options: - `DROPBEAR_DEFAULT_MAX_DURATION` - `DROPBEAR_MAX_PUBKEY_QUERIES` - fix `DROPBEAR_MLKEM768` description (fixes commit d8ff2d8cba) - **init script**: - try to detect supported (hostkey) algorithms; otherwise fallback to predefined list; - improve hostkey generation before start; - add new UCI config option: - `MaxSessionDuration`: maximum session duration (seconds); overrides `DROPBEAR_DEFAULT_MAX_DURATION` build-time value. - **failsafe script**: - try to detect supported (hostkey) algorithms; otherwise fallback to predefined list; - generate or use RSA only if none of the modern algorithms (Ed25519, ECDSA) are supported; - remove key size constraints: - Ed25519: only one size is applicable; - ECDSA: custom build may include only 384- or 521-bit curves; - RSA: default RSA key size is 2048 bits, which is sufficient for SSH security recommendations, and the previous value of 1024 bits is considered insecure. - **size changes**: Build-tested for `ath79/generic` (`mips`). - binary package (`.apk`): 123437 -> 126752 (+3315) - `/usr/sbin/dropbear`: 231572 -> 239784 (+8212) `scripts/diffconfig.sh`: ```sh CONFIG_TARGET_ath79=y CONFIG_TARGET_ath79_generic=y CONFIG_TARGET_ath79_generic_DEVICE_tplink_archer-c7-v5=y CONFIG_DEVEL=y CONFIG_TOOLCHAINOPTS=y # CONFIG_BINUTILS_USE_VERSION_2_44 is not set CONFIG_BINUTILS_USE_VERSION_2_46=y CONFIG_BINUTILS_VERSION="2.46.0" CONFIG_BINUTILS_VERSION_2_46=y # CONFIG_GCC_USE_VERSION_14 is not set CONFIG_GCC_USE_VERSION_15=y CONFIG_GCC_VERSION="15.2.0" CONFIG_GCC_VERSION_15=y ```