Changelog for dropbear: 2026.92 -> 2026.93
Source: CHANGES

2026.93 - 21 July 2026

Note >> for compatibility/configuration changes

- Security: Fix a use-after-free in X11 forwarding that could possibly lead
  to memory corruption. This is vulnerable to authenticated users if X11
  forwarding is enabled. By default X11 forwarding is not built.
  In 2026.89 the server is running as the authenticated user for X11
  forwarding, in earlier versions it runs as root.
  This removes X11 "single connection" which has probably never been used.
  Reported by @peter-pe
  https://github.com/mkj/dropbear/commit/882f83806d5e133037cd28e954a878984ef7b9c4

- >> "permitlisten" authorized_keys lines will now be ignored if
  the port is invalid (>65536). From Basavaraj S Maneppagol.

- >> In 2026.92, the configure option --enable-plugin-deprecated
  wasn't correctly renamed. This is now implemented.
  Patch from Alexander Dahl

- Two factor auth "-t" is no longer deprecated, it will be kept.
  The "DEPRECATED_TWO_FACTOR" option is ignored, and no longer required.

- Fix out of bounds read during utmp/wtmp log file handling, reported by
  Basavaraj S Maneppagol.

- More robust handling of ascii inputs for some platforms.
  From Basavaraj S Maneppagol

- Convert manpages to mdoc format, from shrub

  [Updated 16 July: This is no longer planned to be removed, future releases
  will ignore DEPRECATED_TWO_FACTOR and always enable it, like previously]