Dropbear vulnerabilities by version: why the NVD counts nothing from 2022.83 on

How many CVEs does the NVD list for my Dropbear version?

Counted are CVEs whose NVD configuration lists the version as vulnerable, queried on 12 November 2026 through the NVD API without rejected entries, each hit re-checked against its configuration. The NVD knows three product names for Dropbear; all 20 Dropbear CVEs with a configuration sit under cpe:2.3:a:dropbear_ssh_project:dropbear_ssh, the other two return no hits.

From 2020.81 on, no version has a CVE with CVSS 9.0 or higher. The NVD's two 9.8 entries (CVE-2016-7406 and -7407) have been fixed since 2016.74.

$ curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?virtualMatchString=cpe:2.3:a:dropbear_ssh_project:dropbear_ssh:2022.83&noRejected"  \
| jq .totalResults

0

$ curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?virtualMatchString=cpe:2.3:a:dropbear_ssh_project:dropbear_ssh:2020.81&noRejected"  \
| jq .totalResults

2

Is Dropbear 2022.83 affected by Terrapin?

Yes. CVE-2023-48795 (Terrapin) is an attack on the SSH protocol that removes messages at the start of a connection. The CVE text names “Dropbear through 2022.83”, but the NVD configuration ends before 2022.83. A query by version therefore does not find the vulnerability for 2022.83.

Dropbear added the protection, strict KEX, in November 2023; the first release with it is 2024.84. Yocto 5.0 and Debian 12 ship 2022.83 and patch Terrapin themselves, OpenWrt 23.05 backports strict KEX into its 2022.82.

Which Dropbear vulnerabilities are missing from the version query?

On 12 November 2026, three Dropbear CVEs have no configuration in the NVD (status “Deferred”) and appear in no version query.

What did releases 2026.90 to 2026.94 fix?

Dropbear's change list names eight security fixes for 2026.90 to 2026.93. The NVD maps none of them to a Dropbear version; two refer to OpenSSH CVEs. A CVE query does not find them, a check against the change list does.

After 2026.94, ten more commits sit on the development branch, among them a fix to the terminal output of scp and a build check for builds without dropping root privileges. There is no release with them.

Which Dropbear version do Yocto, OpenWrt and Buildroot ship?

Read from the recipes at the release tags and branches on 12 November 2026: Yocto meta/recipes-core/dropbear, OpenWrt package/network/services/dropbear/Makefile, Buildroot package/dropbear/dropbear.mk.

Yocto 6.0 ships 2025.89 without a CVE patch. OpenWrt 25.12 ships the same version and backports the security fixes from 2026.90. The version line is the same in both cases.

Where is the Dropbear version in the binary?

Dropbear builds its identification from src/sysoptions.h: “SSH-2.0-dropbear_” and the version. It sits as text in the binary and goes to the other side as the first line of every SSH connection, so a device also reports its version over the network. Whoever builds Dropbear can override the version part; then it is missing. OpenWrt does exactly that: 24.10 fixes the identification to “SSH-2.0-dropbear”, 25.12 empties the version part. The binary then holds the number only on its own, for example before the text “Dropbear SSH client v%s”.

The line names the upstream version, never the distribution's patch level.

$ strings -a usr/sbin/dropbear | grep -m1 "SSH-2.0-dropbear"

SSH-2.0-dropbear_2025.89

$ strings -a usr/sbin/dropbear | grep -B1 -m1 "^Dropbear SSH client v"

2024.86
Dropbear SSH client v%s https://matt.ucc.asn.au/dropbear/dropbear.html

How do I check this by hand?

1. 1

   Read the version: strings -a usr/sbin/dropbear | grep -m1 "SSH-2.0-dropbear" in the unpacked file system, for OpenWrt grep -B1 -m1 "^Dropbear SSH client v" instead of the pattern, on a running device the first line of a connection to port 22 (without a version on OpenWrt).

2. 2

   Find the origin: Yocto, Buildroot, OpenWrt or a build of your own. For Yocto and OpenWrt, read the patches in the recipe; they are not in the version line.

3. 3

   Find the features: is the dbclient client built, is scp included, is X11 forwarding enabled? Several vulnerabilities only affect these parts.

4. 4

   Query the NVD with cpe:2.3:a:dropbear_ssh_project:dropbear_ssh:<version>, then read Terrapin and the three CVEs without NVD mapping against your version.

5. 5

   Read Dropbear's change list from your version on for “Security”; of the 2026 fixes, only the one for CVE-2026-3706 carries a Dropbear CVE.

6. 6

   Check the CISA KEV catalogue for actively exploited vulnerabilities.

Can this be done automatically?

LegacyMind reads Dropbear, the kernel and the packages with their versions from the image and checks each against the public vulnerability sources, with the location in the image and a note when a vulnerability is actively exploited. If the image proves no version, the field stays empty.