@Viss @mroach @FritzAdalis @jschauma Or “Terrapin”. An attacker has to be in a position to discard arbitrary packets from an SSH negotiation, and the only impact on most versions of OpenSSH is a DoS. Which an attacker in that position could cause by discarding the SYNs. Better spend person-months in change control to disable chacha20-poly1305 everywhere!