RHSA-2026:7067

Vulnerability from csaf_redhat - Published: 2026-04-08 13:23 - Updated: 2026-05-19 09:11
Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Severity
Moderate
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs:
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2025-14821

A flaw was found in libssh. This vulnerability allows local man-in-the-middle attacks, security downgrades of SSH (Secure Shell) connections, and manipulation of trusted host information, posing a significant risk to the confidentiality, integrity, and availability of SSH communications via an insecure default configuration on Windows systems where the library automatically loads configuration files from the C:\etc directory, which can be created and modified by unprivileged local users.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-427 - Uncontrolled Search Path Element
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat Hardened Images:libssh-main@aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:libssh-main@noarch —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:libssh-main@src —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:libssh-main@x86_64 —
Vendor Fix fix
Workaround
Threats
Impact Low
CVE-2026-0966

A flaw was found in libssh. The API function `ssh_get_hexa()` is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI (Generic Security Service Application Program Interface) authentication if the server's logging verbosity is set to `SSH_LOG_PACKET (3)` or higher. Successful exploitation could lead to a self-Denial of Service of the per-connection daemon process.

6.5 (Medium)
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
CWE-124 - Buffer Underwrite ('Buffer Underflow')
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat Hardened Images:libssh-main@aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:libssh-main@noarch —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:libssh-main@src —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:libssh-main@x86_64 —
Vendor Fix fix
Workaround
Threats
Impact Moderate
CVE-2026-3731

A flaw was found in libssh. A remote attacker could trigger an out-of-bounds read vulnerability in the SFTP Extension Name Handler by manipulating the `idx` argument in the `sftp_extensions_get_name` or `sftp_extensions_get_data` functions. This could lead to a Denial of Service (DoS), making the affected system unresponsive.

5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-125 - Out-of-bounds Read
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat Hardened Images:libssh-main@aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:libssh-main@noarch —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:libssh-main@src —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat Hardened Images:libssh-main@x86_64 —
Vendor Fix fix
Workaround
Threats
Impact Moderate
References
Acknowledgments
Martin Grubhofer
Kang Yang Yunhang Zhang Jun Xu
libssh Jakub Jelen
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:7067",
        "url": "https://access.redhat.com/errata/RHSA-2026:7067"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-3731",
        "url": "https://access.redhat.com/security/cve/CVE-2026-3731"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-0966",
        "url": "https://access.redhat.com/security/cve/CVE-2026-0966"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-14821",
        "url": "https://access.redhat.com/security/cve/CVE-2025-14821"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7067.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-05-19T09:11:20+00:00",
      "generator": {
        "date": "2026-05-19T09:11:20+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.0"
        }
      },
      "id": "RHSA-2026:7067",
      "initial_release_date": "2026-04-08T13:23:35+00:00",
      "revision_history": [
        {
          "date": "2026-04-08T13:23:35+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-04-24T23:24:37+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-19T09:11:20+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libssh-main@aarch64",
                "product": {
                  "name": "libssh-main@aarch64",
                  "product_id": "libssh-main@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libssh@0.12.0-1.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libssh-main@src",
                "product": {
                  "name": "libssh-main@src",
                  "product_id": "libssh-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libssh@0.12.0-1.1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libssh-main@x86_64",
                "product": {
                  "name": "libssh-main@x86_64",
                  "product_id": "libssh-main@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libssh@0.12.0-1.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libssh-main@noarch",
                "product": {
                  "name": "libssh-main@noarch",
                  "product_id": "libssh-main@noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libssh-config@0.12.0-1.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libssh-main@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:libssh-main@aarch64"
        },
        "product_reference": "libssh-main@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libssh-main@noarch as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:libssh-main@noarch"
        },
        "product_reference": "libssh-main@noarch",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libssh-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:libssh-main@src"
        },
        "product_reference": "libssh-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libssh-main@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:libssh-main@x86_64"
        },
        "product_reference": "libssh-main@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Martin Grubhofer"
          ]
        }
      ],
      "cve": "CVE-2025-14821",
      "cwe": {
        "id": "CWE-427",
        "name": "Uncontrolled Search Path Element"
      },
      "discovery_date": "2025-12-17T11:43:02.072000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2423148"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libssh. This vulnerability allows local man-in-the-middle attacks, security downgrades of SSH (Secure Shell) connections, and manipulation of trusted host information, posing a significant risk to the confidentiality, integrity, and availability of SSH communications via an insecure default configuration on Windows systems where the library automatically loads configuration files from the C:\\etc directory, which can be created and modified by unprivileged local users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libssh: libssh: Insecure default configuration leads to local man-in-the-middle attacks on Windows",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Low for Red Hat products. The flaw in libssh is specific to its insecure default configuration on Windows systems, where it loads configuration from the C:\\etc directory. Red Hat\u0027s Linux-based products do not utilize this configuration path, and therefore are not affected by this vulnerability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:libssh-main@aarch64",
          "Red Hat Hardened Images:libssh-main@noarch",
          "Red Hat Hardened Images:libssh-main@src",
          "Red Hat Hardened Images:libssh-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-14821"
        },
        {
          "category": "external",
          "summary": "RHBZ#2423148",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423148"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-14821",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-14821"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14821",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14821"
        },
        {
          "category": "external",
          "summary": "https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/",
          "url": "https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/"
        }
      ],
      "release_date": "2026-02-10T18:51:56.639000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T13:23:35+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7067"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "libssh: libssh: Insecure default configuration leads to local man-in-the-middle attacks on Windows"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Kang Yang",
            "Yunhang Zhang",
            "Jun Xu"
          ]
        },
        {
          "names": [
            "Jakub Jelen"
          ],
          "organization": "libssh"
        }
      ],
      "cve": "CVE-2026-0966",
      "cwe": {
        "id": "CWE-124",
        "name": "Buffer Underwrite (\u0027Buffer Underflow\u0027)"
      },
      "discovery_date": "2026-01-26T23:14:46.617000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2433121"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libssh. The API function `ssh_get_hexa()` is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI (Generic Security Service Application Program Interface) authentication if the server\u0027s logging verbosity is set to `SSH_LOG_PACKET (3)` or higher. Successful exploitation could lead to a self-Denial of Service of the per-connection daemon process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libssh: libssh: Denial of Service via zero-length input in ssh_get_hexa()",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Attack Complexity is high as it requires the logging verbosity to be set to `SSH_LOG_PACKET (3)` or higher, which is not the default configuration in Red Hat Enterprise Linux.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:libssh-main@aarch64",
          "Red Hat Hardened Images:libssh-main@noarch",
          "Red Hat Hardened Images:libssh-main@src",
          "Red Hat Hardened Images:libssh-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-0966"
        },
        {
          "category": "external",
          "summary": "RHBZ#2433121",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433121"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-0966",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-0966"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0966",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0966"
        },
        {
          "category": "external",
          "summary": "https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/",
          "url": "https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/"
        }
      ],
      "release_date": "2026-02-10T18:47:15.531000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T13:23:35+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7067"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, consider disabling GSSAPI authentication if it is not required, or reduce the `LogLevel` in the `sshd_config` file to a value lower than `SSH_LOG_PACKET` (e.g., `INFO`).\n\nTo disable GSSAPI authentication, add or modify the following line in `/etc/ssh/sshd_config`:\n`GSSAPIAuthentication no`\n\nTo reduce logging verbosity, add or modify the following line in `/etc/ssh/sshd_config`:\n`LogLevel INFO`\n\nAfter making changes to `sshd_config`, the `sshd` service must be restarted for the changes to take effect. This may temporarily interrupt active SSH sessions.",
          "product_ids": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.0"
          },
          "products": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libssh: libssh: Denial of Service via zero-length input in ssh_get_hexa()"
    },
    {
      "cve": "CVE-2026-3731",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-03-08T11:01:00.569703+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2445579"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libssh. A remote attacker could trigger an out-of-bounds read vulnerability in the SFTP Extension Name Handler by manipulating the `idx` argument in the `sftp_extensions_get_name` or `sftp_extensions_get_data` functions. This could lead to a Denial of Service (DoS), making the affected system unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libssh: libssh: Denial of Service via out-of-bounds read in SFTP extension name handler",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A MODERATE impact out-of-bounds read vulnerability exists in libssh\u0027s SFTP extension. A remote attacker could exploit this flaw by manipulating an argument to the `sftp_extensions_get_name/sftp_extensions_get_data` functions, potentially leading to a denial of service or information disclosure. This affects Red Hat Enterprise Linux versions utilizing libssh.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:libssh-main@aarch64",
          "Red Hat Hardened Images:libssh-main@noarch",
          "Red Hat Hardened Images:libssh-main@src",
          "Red Hat Hardened Images:libssh-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-3731"
        },
        {
          "category": "external",
          "summary": "RHBZ#2445579",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445579"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-3731",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-3731"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3731",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3731"
        },
        {
          "category": "external",
          "summary": "https://gitlab.com/libssh/libssh-mirror/-/commit/855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60",
          "url": "https://gitlab.com/libssh/libssh-mirror/-/commit/855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/?ctiid.349709",
          "url": "https://vuldb.com/?ctiid.349709"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/?id.349709",
          "url": "https://vuldb.com/?id.349709"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/?submit.767120",
          "url": "https://vuldb.com/?submit.767120"
        },
        {
          "category": "external",
          "summary": "https://www.libssh.org/files/0.12/libssh-0.12.0.tar.xz",
          "url": "https://www.libssh.org/files/0.12/libssh-0.12.0.tar.xz"
        },
        {
          "category": "external",
          "summary": "https://www.libssh.org/security/advisories/libssh-2026-sftp-extensions.txt",
          "url": "https://www.libssh.org/security/advisories/libssh-2026-sftp-extensions.txt"
        }
      ],
      "release_date": "2026-03-08T10:32:19.482000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T13:23:35+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7067"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libssh: libssh: Denial of Service via out-of-bounds read in SFTP extension name handler"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.