Hi,

The following vulnerability was published for fail2ban.

CVE-2026-109786[0]:
| In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter
| (config/filter.d/sshd.conf) accepts an "on <token>" suffix after the
| host address. Because OpenSSH logs the offered username verbatim, a
| remote unauthenticated attacker can use a username such as "x
| VICTIM-SOURCE-IP-ADDRESS on" to make fail2ban associate failed login
| attempts with an arbitrary source IP address and ban it (e.g., to
| block logins from a legitimate user). The default filter mode is
| affected.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-109786
https://www.cve.org/CVERecord?id=CVE-2026-109786
[1] https://github.com/fail2ban/fail2ban/commit/ddd879d22664904ace24e1255ac6571808c58187

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore