FKIE_CVE-2026-0966

Vulnerability from fkie_nvd - Published: 2026-03-26 21:17 - Updated: 2026-03-30 13:26
Severity ?
6.5 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Summary
The API function `ssh_get_hexa()` is vulnerable, when 0-lenght input is provided to this function. This function is used internally in `ssh_get_fingerprint_hash()` and `ssh_print_hexa()` (deprecated), which is vulnerable to the same input (length is provided by the calling application). The function is also used internally in the gssapi code for logging the OIDs received by the server during GSSAPI authentication. This could be triggered remotely, when the server allows GSSAPI authentication and logging verbosity is set at least to SSH_LOG_PACKET (3). This could cause self-DoS of the per-connection daemon process.
References
secalert@redhat.comhttps://access.redhat.com/security/cve/CVE-2026-0966
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=2433121
secalert@redhat.comhttps://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/
Impacted products
Vendor Product Version
To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The API function `ssh_get_hexa()` is vulnerable, when 0-lenght\ninput is provided to this function. This function is used internally\nin `ssh_get_fingerprint_hash()` and `ssh_print_hexa()` (deprecated),\nwhich is vulnerable to the same input (length is provided by the\ncalling application).\n\nThe function is also used internally in the gssapi code for logging\nthe OIDs received by the server during GSSAPI authentication. This\ncould be triggered remotely, when the server allows GSSAPI authentication\nand logging verbosity is set at least to SSH_LOG_PACKET (3). This\ncould cause self-DoS of the per-connection daemon process."
    },
    {
      "lang": "es",
      "value": "La funci\u00f3n API \u0027ssh_get_hexa()\u0027 es vulnerable cuando se proporciona una entrada de longitud 0 a esta funci\u00f3n. Esta funci\u00f3n se utiliza internamente en \u0027ssh_get_fingerprint_hash()\u0027 y \u0027ssh_print_hexa()\u0027 (obsoleta), la cual es vulnerable a la misma entrada (la longitud es proporcionada por la aplicaci\u00f3n que realiza la llamada).\n\nLa funci\u00f3n tambi\u00e9n se utiliza internamente en el c\u00f3digo gssapi para registrar los OID recibidos por el servidor durante la autenticaci\u00f3n GSSAPI. Esto podr\u00eda activarse de forma remota cuando el servidor permite la autenticaci\u00f3n GSSAPI y la verbosidad del registro se establece al menos en SSH_LOG_PACKET (3). Esto podr\u00eda causar un auto-DoS del proceso demonio por conexi\u00f3n."
    }
  ],
  "id": "CVE-2026-0966",
  "lastModified": "2026-03-30T13:26:50.827",
  "metrics": {
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
          "version": "3.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.5,
        "source": "secalert@redhat.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-03-26T21:17:00.783",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/security/cve/CVE-2026-0966"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433121"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-124"
        }
      ],
      "source": "secalert@redhat.com",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.