Vulnerability-Lookup

SUSE-SU-2026:23056-1

Vulnerability from csaf_suse - Published: 2026-08-06 11:02 - Updated: 2026-09-16 20:10

Summary

Security update for libssh

Severity

Moderate

Notes

Title of the patch: Security update for libssh

Description of the patch: This update for libssh fixes the following issues: - CVE-2026-3731: denial of Service via out-of-bounds read in SFTP extension name handler (bsc#1259377). - CVE-2026-59843: denial of service via zero advertised channel packet size (bsc#1272164). - CVE-2026-59844: denial of service via oversized SFTP read length (bsc#1272165). - CVE-2026-59845: denial of service via unchecked ProxyCommand fork() failure (bsc#1272166). - CVE-2026-59846: information disclosure via ProxyCommand %r username expansion (bsc#1272167). - CVE-2026-59847: integrity downgrade via OpenSSL AES-GCM tag verification (bsc#1272168). - CVE-2026-59848: denial of service via SFTP responses with unknown request IDs (bsc#1272169). - CVE-2026-59850: use-after-free via data callbacks on closed channels (bsc#1272171).

Patchnames: SUSE-SLE-Micro-6.0-834

CVE-2026-3731

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

Recommended 6 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-59843

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 6 products, the same list as for CVE-2026-3731

Threats

Impact moderate

CVE-2026-59844

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 6 products, the same list as for CVE-2026-3731

Threats

Impact moderate

CVE-2026-59845

6.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Affected products

Recommended 6 products, the same list as for CVE-2026-3731

Threats

Impact moderate

CVE-2026-59846

3.9 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Affected products

Recommended 6 products, the same list as for CVE-2026-3731

Threats

Impact low

CVE-2026-59847

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L

Affected products

Recommended 6 products, the same list as for CVE-2026-3731

Threats

Impact moderate

CVE-2026-59848

3.7 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

Recommended 6 products, the same list as for CVE-2026-3731

Threats

Impact moderate

CVE-2026-59850

4.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Affected products

Recommended 6 products, the same list as for CVE-2026-3731

Threats

Impact moderate

References

36 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://lists.suse.com/pipermail/sle-updates/2026…	self
https://bugzilla.suse.com/1259377	self
https://bugzilla.suse.com/1272164	self
https://bugzilla.suse.com/1272165	self
https://bugzilla.suse.com/1272166	self
https://bugzilla.suse.com/1272167	self
https://bugzilla.suse.com/1272168	self
https://bugzilla.suse.com/1272169	self
https://bugzilla.suse.com/1272171	self
https://www.suse.com/security/cve/CVE-2026-3731/	self
https://www.suse.com/security/cve/CVE-2026-59843/	self
https://www.suse.com/security/cve/CVE-2026-59844/	self
https://www.suse.com/security/cve/CVE-2026-59845/	self
https://www.suse.com/security/cve/CVE-2026-59846/	self
https://www.suse.com/security/cve/CVE-2026-59847/	self
https://www.suse.com/security/cve/CVE-2026-59848/	self
https://www.suse.com/security/cve/CVE-2026-59850/	self
https://www.suse.com/security/cve/CVE-2026-3731	external
https://bugzilla.suse.com/1259377	external
https://www.suse.com/security/cve/CVE-2026-59843	external
https://bugzilla.suse.com/1272164	external
https://www.suse.com/security/cve/CVE-2026-59844	external
https://bugzilla.suse.com/1272165	external
https://www.suse.com/security/cve/CVE-2026-59845	external
https://bugzilla.suse.com/1272166	external
https://www.suse.com/security/cve/CVE-2026-59846	external
https://bugzilla.suse.com/1272167	external
https://www.suse.com/security/cve/CVE-2026-59847	external
https://bugzilla.suse.com/1272168	external
https://www.suse.com/security/cve/CVE-2026-59848	external
https://bugzilla.suse.com/1272169	external
https://www.suse.com/security/cve/CVE-2026-59850	external
https://bugzilla.suse.com/1272171	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for libssh",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for libssh fixes the following issues:\n\n- CVE-2026-3731: denial of Service via out-of-bounds read in SFTP extension name handler (bsc#1259377).\n- CVE-2026-59843: denial of service via zero advertised channel packet size (bsc#1272164).\n- CVE-2026-59844: denial of service via oversized SFTP read length (bsc#1272165).\n- CVE-2026-59845: denial of service via unchecked ProxyCommand fork() failure (bsc#1272166).\n- CVE-2026-59846: information disclosure via ProxyCommand %r username expansion (bsc#1272167).\n- CVE-2026-59847: integrity downgrade via OpenSSL AES-GCM tag verification (bsc#1272168).\n- CVE-2026-59848: denial of service via SFTP responses with unknown request IDs (bsc#1272169).\n- CVE-2026-59850: use-after-free via data callbacks on closed channels (bsc#1272171).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-Micro-6.0-834",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_23056-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:23056-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202623056-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:23056-1",
        "url": "https://lists.suse.com/pipermail/sle-updates/2026-August/049229.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1259377",
        "url": "https://bugzilla.suse.com/1259377"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1272164",
        "url": "https://bugzilla.suse.com/1272164"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1272165",
        "url": "https://bugzilla.suse.com/1272165"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1272166",
        "url": "https://bugzilla.suse.com/1272166"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1272167",
        "url": "https://bugzilla.suse.com/1272167"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1272168",
        "url": "https://bugzilla.suse.com/1272168"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1272169",
        "url": "https://bugzilla.suse.com/1272169"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1272171",
        "url": "https://bugzilla.suse.com/1272171"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-3731 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-3731/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-59843 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-59843/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-59844 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-59844/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-59845 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-59845/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-59846 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-59846/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-59847 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-59847/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-59848 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-59848/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-59850 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-59850/"
      }
    ],
    "title": "Security update for libssh",
    "tracking": {
      "current_release_date": "2026-09-16T20:10:29Z",
      "generator": {
        "date": "2026-08-06T11:02:18Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:23056-1",
      "initial_release_date": "2026-08-06T11:02:18Z",
      "revision_history": [
        {
          "date": "2026-08-06T11:02:18Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-16T19:22:24Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-16T20:10:29Z",
          "number": "3",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libssh-config-0.10.6-5.1.aarch64",
                "product": {
                  "name": "libssh-config-0.10.6-5.1.aarch64",
                  "product_id": "libssh-config-0.10.6-5.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:libssh:libssh:0.10.6:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/libssh-config@0.10.6-5.1?arch=aarch64\u0026upstream=libssh-0.10.6-5.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libssh4-0.10.6-5.1.aarch64",
                "product": {
                  "name": "libssh4-0.10.6-5.1.aarch64",
                  "product_id": "libssh4-0.10.6-5.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:libssh:libssh:0.10.6:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/libssh4@0.10.6-5.1?arch=aarch64\u0026upstream=libssh-0.10.6-5.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libssh-config-0.10.6-5.1.s390x",
                "product": {
                  "name": "libssh-config-0.10.6-5.1.s390x",
                  "product_id": "libssh-config-0.10.6-5.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:libssh:libssh:0.10.6:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/libssh-config@0.10.6-5.1?arch=s390x\u0026upstream=libssh-0.10.6-5.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libssh4-0.10.6-5.1.s390x",
                "product": {
                  "name": "libssh4-0.10.6-5.1.s390x",
                  "product_id": "libssh4-0.10.6-5.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:libssh:libssh:0.10.6:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/libssh4@0.10.6-5.1?arch=s390x\u0026upstream=libssh-0.10.6-5.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libssh-config-0.10.6-5.1.x86_64",
                "product": {
                  "name": "libssh-config-0.10.6-5.1.x86_64",
                  "product_id": "libssh-config-0.10.6-5.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:libssh:libssh:0.10.6:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/libssh-config@0.10.6-5.1?arch=x86_64\u0026upstream=libssh-0.10.6-5.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libssh4-0.10.6-5.1.x86_64",
                "product": {
                  "name": "libssh4-0.10.6-5.1.x86_64",
                  "product_id": "libssh4-0.10.6-5.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:libssh:libssh:0.10.6:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/libssh4@0.10.6-5.1?arch=x86_64\u0026upstream=libssh-0.10.6-5.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Micro 6.0",
                "product": {
                  "name": "SUSE Linux Micro 6.0",
                  "product_id": "SUSE Linux Micro 6.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sl-micro:6.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libssh-config-0.10.6-5.1.aarch64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.aarch64"
        },
        "product_reference": "libssh-config-0.10.6-5.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libssh-config-0.10.6-5.1.s390x as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.s390x"
        },
        "product_reference": "libssh-config-0.10.6-5.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libssh-config-0.10.6-5.1.x86_64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.x86_64"
        },
        "product_reference": "libssh-config-0.10.6-5.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libssh4-0.10.6-5.1.aarch64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.aarch64"
        },
        "product_reference": "libssh4-0.10.6-5.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libssh4-0.10.6-5.1.s390x as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.s390x"
        },
        "product_reference": "libssh4-0.10.6-5.1.s390x",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libssh4-0.10.6-5.1.x86_64 as component of SUSE Linux Micro 6.0",
          "product_id": "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.x86_64"
        },
        "product_reference": "libssh4-0.10.6-5.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Micro 6.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-3731",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-3731"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.aarch64",
          "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.s390x",
          "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.x86_64",
          "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.aarch64",
          "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.s390x",
          "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-3731",
          "url": "https://www.suse.com/security/cve/CVE-2026-3731"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1259377 for CVE-2026-3731",
          "url": "https://bugzilla.suse.com/1259377"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.aarch64",
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.s390x",
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.x86_64",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.aarch64",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.s390x",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.aarch64",
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.s390x",
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.x86_64",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.aarch64",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.s390x",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-06T11:02:18Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-3731"
    },
    {
      "cve": "CVE-2026-59843",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-59843"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later channel writes to loop indefinitely and consume CPU, leading to denial of service.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.aarch64",
          "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.s390x",
          "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.x86_64",
          "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.aarch64",
          "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.s390x",
          "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-59843",
          "url": "https://www.suse.com/security/cve/CVE-2026-59843"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272164 for CVE-2026-59843",
          "url": "https://bugzilla.suse.com/1272164"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.aarch64",
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.s390x",
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.x86_64",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.aarch64",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.s390x",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.aarch64",
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.s390x",
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.x86_64",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.aarch64",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.s390x",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-06T11:02:18Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-59843"
    },
    {
      "cve": "CVE-2026-59844",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-59844"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.aarch64",
          "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.s390x",
          "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.x86_64",
          "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.aarch64",
          "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.s390x",
          "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-59844",
          "url": "https://www.suse.com/security/cve/CVE-2026-59844"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272165 for CVE-2026-59844",
          "url": "https://bugzilla.suse.com/1272165"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.aarch64",
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.s390x",
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.x86_64",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.aarch64",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.s390x",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.aarch64",
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.s390x",
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.x86_64",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.aarch64",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.s390x",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-06T11:02:18Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-59844"
    },
    {
      "cve": "CVE-2026-59845",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-59845"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller\u0027s accessible process tree, leading to local denial of service.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.aarch64",
          "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.s390x",
          "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.x86_64",
          "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.aarch64",
          "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.s390x",
          "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-59845",
          "url": "https://www.suse.com/security/cve/CVE-2026-59845"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272166 for CVE-2026-59845",
          "url": "https://bugzilla.suse.com/1272166"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.aarch64",
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.s390x",
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.x86_64",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.aarch64",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.s390x",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.aarch64",
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.s390x",
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.x86_64",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.aarch64",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.s390x",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-06T11:02:18Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-59845"
    },
    {
      "cve": "CVE-2026-59846",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-59846"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.aarch64",
          "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.s390x",
          "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.x86_64",
          "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.aarch64",
          "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.s390x",
          "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-59846",
          "url": "https://www.suse.com/security/cve/CVE-2026-59846"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272167 for CVE-2026-59846",
          "url": "https://bugzilla.suse.com/1272167"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.aarch64",
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.s390x",
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.x86_64",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.aarch64",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.s390x",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.9,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.aarch64",
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.s390x",
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.x86_64",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.aarch64",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.s390x",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-06T11:02:18Z",
          "details": "low"
        }
      ],
      "title": "CVE-2026-59846"
    },
    {
      "cve": "CVE-2026-59847",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-59847"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.aarch64",
          "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.s390x",
          "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.x86_64",
          "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.aarch64",
          "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.s390x",
          "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-59847",
          "url": "https://www.suse.com/security/cve/CVE-2026-59847"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272168 for CVE-2026-59847",
          "url": "https://bugzilla.suse.com/1272168"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.aarch64",
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.s390x",
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.x86_64",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.aarch64",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.s390x",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.aarch64",
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.s390x",
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.x86_64",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.aarch64",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.s390x",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-06T11:02:18Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-59847"
    },
    {
      "cve": "CVE-2026-59848",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-59848"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.aarch64",
          "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.s390x",
          "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.x86_64",
          "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.aarch64",
          "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.s390x",
          "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-59848",
          "url": "https://www.suse.com/security/cve/CVE-2026-59848"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272169 for CVE-2026-59848",
          "url": "https://bugzilla.suse.com/1272169"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.aarch64",
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.s390x",
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.x86_64",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.aarch64",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.s390x",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.aarch64",
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.s390x",
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.x86_64",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.aarch64",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.s390x",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-06T11:02:18Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-59848"
    },
    {
      "cve": "CVE-2026-59850",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-59850"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.aarch64",
          "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.s390x",
          "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.x86_64",
          "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.aarch64",
          "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.s390x",
          "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-59850",
          "url": "https://www.suse.com/security/cve/CVE-2026-59850"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1272171 for CVE-2026-59850",
          "url": "https://bugzilla.suse.com/1272171"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.aarch64",
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.s390x",
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.x86_64",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.aarch64",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.s390x",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.aarch64",
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.s390x",
            "SUSE Linux Micro 6.0:libssh-config-0.10.6-5.1.x86_64",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.aarch64",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.s390x",
            "SUSE Linux Micro 6.0:libssh4-0.10.6-5.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-06T11:02:18Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-59850"
    }
  ]
}

CVE-2026-3731 (GCVE-0-2026-3731)

Vulnerability from cvelistv5 – Published: 2026-03-08 10:32 – Updated: 2026-03-11 19:50

Title

libssh SFTP Extension Name sftp.c sftp_extensions_get_data out-of-bounds

Summary

A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C

5.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-11 19:50 UTC

CWE

CWE-125 - Out-of-Bounds Read
CWE-119 - Memory Corruption

Assigner

VulDB mitre root

References

6 references

URL	Tags
https://vuldb.com/?id.349709	vdb-entrytechnical-description
https://vuldb.com/?ctiid.349709	signaturepermissions-required
https://vuldb.com/?submit.767120	third-party-advisory
https://www.libssh.org/security/advisories/libssh…	related
https://gitlab.com/libssh/libssh-mirror/-/commit/…	patch
https://www.libssh.org/files/0.12/libssh-0.12.0.tar.xz	patch

Impacted products

1 product

Vendor	Product	Version
n/a	libssh	Affected: 0.11.0 Affected: 0.11.1 Affected: 0.11.2 Affected: 0.11.3 Unaffected: 0.11.4 Unaffected: 0.12.0 cpe:2.3:a:libssh:libssh::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-3731",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-11T19:50:26.998747Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-11T19:50:33.441Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:libssh:libssh:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "SFTP Extension Name Handler"
          ],
          "product": "libssh",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "0.11.0"
            },
            {
              "status": "affected",
              "version": "0.11.1"
            },
            {
              "status": "affected",
              "version": "0.11.2"
            },
            {
              "status": "affected",
              "version": "0.11.3"
            },
            {
              "status": "unaffected",
              "version": "0.11.4"
            },
            {
              "status": "unaffected",
              "version": "0.12.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:ND/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-Bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-119",
              "description": "Memory Corruption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-08T10:32:19.482Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-349709 | libssh SFTP Extension Name sftp.c sftp_extensions_get_data out-of-bounds",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.349709"
        },
        {
          "name": "VDB-349709 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.349709"
        },
        {
          "name": "Submit #767120 | libssh.org libssh libssh \u003c 0.11.4; \u003c 0.12.0 Out-of-Bounds Read",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/?submit.767120"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://www.libssh.org/security/advisories/libssh-2026-sftp-extensions.txt"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://gitlab.com/libssh/libssh-mirror/-/commit/855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.libssh.org/files/0.12/libssh-0.12.0.tar.xz"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-03-07T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-03-07T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-03-07T19:00:46.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "libssh SFTP Extension Name sftp.c sftp_extensions_get_data out-of-bounds"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-3731",
    "datePublished": "2026-03-08T10:32:19.482Z",
    "dateReserved": "2026-03-07T17:52:02.964Z",
    "dateUpdated": "2026-03-11T19:50:33.441Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59843 (GCVE-0-2026-59843)

Vulnerability from cvelistv5 – Published: 2026-07-21 11:16 – Updated: 2026-09-01 20:01

Title

Libssh: libssh: denial of service via zero advertised channel packet size

Summary

A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later channel writes to loop indefinitely and consume CPU, leading to denial of service.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-21 12:08 UTC

CWE

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
CWE-400 - Uncontrolled Resource Consumption

Assigner

redhat redhat root

References

6 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:42922	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55855	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62217	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62218	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-59843	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2498176	issue-trackingx_refsource_REDHAT

Impacted products

4 products

Vendor	Product	Version
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:0.12.0-3.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:0.9.6-17.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream cpe:/o:redhat:enterprise_linux:8::baseos
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:0.10.4-19.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream cpe:/o:redhat:enterprise_linux:9::baseos
Red Hat	Red Hat Hardened Images	Unaffected: 0.12.1-4.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1

Date Public

2026-07-21 11:07

Credits

Red Hat would like to thank Haruto Kimura, Rinku Das, and Yi Lin for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59843",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-21T12:08:16.810909Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-21T12:08:28.113Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.2"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.12.0-3.el10_2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.9.6-17.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.9.6-17.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.10.4-19.el9_8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.10.4-19.el9_8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh-main",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0.12.1-4.hum1",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Haruto Kimura, Rinku Das, and Yi Lin for reporting this issue."
        }
      ],
      "datePublic": "2026-07-21T11:07:00.776Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later channel writes to loop indefinitely and consume CPU, leading to denial of service."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-835",
              "description": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T20:01:39.685Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:42922",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:42922"
        },
        {
          "name": "RHSA-2026:55855",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55855"
        },
        {
          "name": "RHSA-2026:62217",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:62217"
        },
        {
          "name": "RHSA-2026:62218",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:62218"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-59843"
        },
        {
          "name": "RHBZ#2498176",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498176"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-29T10:03:47.442Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-07-21T11:07:00.776Z",
          "value": "Made public."
        }
      ],
      "title": "Libssh: libssh: denial of service via zero advertised channel packet size",
      "workarounds": [
        {
          "lang": "en",
          "value": "No workaround available."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-59843",
    "datePublished": "2026-07-21T11:16:12.061Z",
    "dateReserved": "2026-07-07T15:40:24.561Z",
    "dateUpdated": "2026-09-01T20:01:39.685Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59844 (GCVE-0-2026-59844)

Vulnerability from cvelistv5 – Published: 2026-07-21 11:32 – Updated: 2026-09-01 20:01

Title

Libssh: libssh: denial of service via oversized sftp read length

Summary

A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-21 13:11 UTC

CWE

CWE-789 - Memory Allocation with Excessive Size Value

Assigner

redhat redhat root

References

6 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:42922	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55855	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62217	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62218	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-59844	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2498177	issue-trackingx_refsource_REDHAT

Impacted products

4 products

Vendor	Product	Version
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:0.12.0-3.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:0.9.6-17.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream cpe:/o:redhat:enterprise_linux:8::baseos
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:0.10.4-19.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream cpe:/o:redhat:enterprise_linux:9::baseos
Red Hat	Red Hat Hardened Images	Unaffected: 0.12.1-4.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1

Date Public

2026-07-21 11:17

Credits

Red Hat would like to thank Chanho Kim for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59844",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-21T13:11:22.542338Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-21T14:55:29.675Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.2"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.12.0-3.el10_2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.9.6-17.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.9.6-17.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.10.4-19.el9_8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.10.4-19.el9_8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh-main",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0.12.1-4.hum1",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Chanho Kim for reporting this issue."
        }
      ],
      "datePublic": "2026-07-21T11:17:49.367Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-789",
              "description": "Memory Allocation with Excessive Size Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T20:01:43.079Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:42922",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:42922"
        },
        {
          "name": "RHSA-2026:55855",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55855"
        },
        {
          "name": "RHSA-2026:62217",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:62217"
        },
        {
          "name": "RHSA-2026:62218",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:62218"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-59844"
        },
        {
          "name": "RHBZ#2498177",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498177"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-29T10:03:47.442Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-07-21T11:17:49.367Z",
          "value": "Made public."
        }
      ],
      "title": "Libssh: libssh: denial of service via oversized sftp read length",
      "workarounds": [
        {
          "lang": "en",
          "value": "No workaround available."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-789: Memory Allocation with Excessive Size Value"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-59844",
    "datePublished": "2026-07-21T11:32:16.816Z",
    "dateReserved": "2026-07-07T15:40:24.561Z",
    "dateUpdated": "2026-09-01T20:01:43.079Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59845 (GCVE-0-2026-59845)

Vulnerability from cvelistv5 – Published: 2026-07-21 11:26 – Updated: 2026-09-01 20:01

Title

Libssh: libssh: denial of service via unchecked proxycommand fork() failure

Summary

A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-23 14:29 UTC

CWE

CWE-390 - Detection of Error Condition Without Action

Assigner

redhat redhat root

References

6 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:42922	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55855	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62217	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62218	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-59845	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2498178	issue-trackingx_refsource_REDHAT

Impacted products

4 products

Vendor	Product	Version
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:0.12.0-3.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:0.9.6-17.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream cpe:/o:redhat:enterprise_linux:8::baseos
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:0.10.4-19.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream cpe:/o:redhat:enterprise_linux:9::baseos
Red Hat	Red Hat Hardened Images	Unaffected: 0.12.1-4.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1

Date Public

2026-07-21 11:23

Credits

Red Hat would like to thank Halil Oktay (oblivionsage) for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59845",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-23T14:29:59.822776Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-390",
                "description": "CWE-390 Detection of Error Condition Without Action",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-23T14:30:03.721Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.2"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.12.0-3.el10_2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.9.6-17.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.9.6-17.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.10.4-19.el9_8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.10.4-19.el9_8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh-main",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0.12.1-4.hum1",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Halil Oktay (oblivionsage) for reporting this issue."
        }
      ],
      "datePublic": "2026-07-21T11:23:44.480Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller\u0027s accessible process tree, leading to local denial of service."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-390",
              "description": "Detection of Error Condition Without Action",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T20:01:47.686Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:42922",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:42922"
        },
        {
          "name": "RHSA-2026:55855",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55855"
        },
        {
          "name": "RHSA-2026:62217",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:62217"
        },
        {
          "name": "RHSA-2026:62218",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:62218"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-59845"
        },
        {
          "name": "RHBZ#2498178",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498178"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-29T10:03:47.442Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-07-21T11:23:44.480Z",
          "value": "Made public."
        }
      ],
      "title": "Libssh: libssh: denial of service via unchecked proxycommand fork() failure",
      "workarounds": [
        {
          "lang": "en",
          "value": "To mitigate this issue, avoid using the ProxyCommand feature in libssh client configurations. This prevents the vulnerable code path from being exercised, thereby eliminating the risk of local denial of service due to unchecked fork() failures."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-390: Detection of Error Condition Without Action"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-59845",
    "datePublished": "2026-07-21T11:26:43.884Z",
    "dateReserved": "2026-07-07T15:40:24.561Z",
    "dateUpdated": "2026-09-01T20:01:47.686Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59846 (GCVE-0-2026-59846)

Vulnerability from cvelistv5 – Published: 2026-07-21 12:55 – Updated: 2026-09-01 20:21

Title

Libssh: libssh: information disclosure via proxycommand %r username expansion

Summary

A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.

Severity

3.9 (Low)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-22 14:03 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Assigner

redhat redhat root

References

6 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:42922	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55855	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62217	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62218	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-59846	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2498179	issue-trackingx_refsource_REDHAT

Impacted products

4 products

Vendor	Product	Version
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:0.12.0-3.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:0.9.6-17.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream cpe:/o:redhat:enterprise_linux:8::baseos
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:0.10.4-19.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream cpe:/o:redhat:enterprise_linux:9::baseos
Red Hat	Red Hat Hardened Images	Unaffected: 0.12.1-4.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1

Date Public

2026-07-21 12:46

Credits

Red Hat would like to thank Mikhail Ilin and Saransh Rana for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59846",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T14:03:12.267428Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-77",
                "description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-23T13:40:22.734Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.2"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.12.0-3.el10_2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.9.6-17.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.9.6-17.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.10.4-19.el9_8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.10.4-19.el9_8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh-main",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0.12.1-4.hum1",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Mikhail Ilin and Saransh Rana for reporting this issue."
        }
      ],
      "datePublic": "2026-07-21T12:46:04.558Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Low"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.9,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T20:21:47.724Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:42922",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:42922"
        },
        {
          "name": "RHSA-2026:55855",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55855"
        },
        {
          "name": "RHSA-2026:62217",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:62217"
        },
        {
          "name": "RHSA-2026:62218",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:62218"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-59846"
        },
        {
          "name": "RHBZ#2498179",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498179"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-29T10:03:47.442Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-07-21T12:46:04.558Z",
          "value": "Made public."
        }
      ],
      "title": "Libssh: libssh: information disclosure via proxycommand %r username expansion",
      "workarounds": [
        {
          "lang": "en",
          "value": "Make sure you are not executing connections with untrusted username inputs."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-59846",
    "datePublished": "2026-07-21T12:55:56.532Z",
    "dateReserved": "2026-07-07T15:40:24.561Z",
    "dateUpdated": "2026-09-01T20:21:47.724Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59847 (GCVE-0-2026-59847)

Vulnerability from cvelistv5 – Published: 2026-07-21 13:18 – Updated: 2026-09-01 20:01

Title

Libssh: libssh: integrity downgrade via openssl aes-gcm tag verification

Summary

A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-21 14:03 UTC

CWE

CWE-253 - Incorrect Check of Function Return Value
CWE-1310 - Missing Ability to Patch ROM Code

Assigner

redhat redhat root

References

6 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:42922	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55855	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62217	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62218	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-59847	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2498180	issue-trackingx_refsource_REDHAT

Impacted products

4 products

Vendor	Product	Version
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:0.12.0-3.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:0.9.6-17.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream cpe:/o:redhat:enterprise_linux:8::baseos
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:0.10.4-19.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream cpe:/o:redhat:enterprise_linux:9::baseos
Red Hat	Red Hat Hardened Images	Unaffected: 0.12.1-4.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1

Date Public

2026-07-21 13:02

Credits

Red Hat would like to thank Ben Smyth for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59847",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-21T14:03:33.644166Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-1310",
                "description": "CWE-1310 Missing Ability to Patch ROM Code",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-21T14:06:22.692Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.2"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.12.0-3.el10_2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.9.6-17.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.9.6-17.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.10.4-19.el9_8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.10.4-19.el9_8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh-main",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0.12.1-4.hum1",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Ben Smyth for reporting this issue."
        }
      ],
      "datePublic": "2026-07-21T13:02:11.381Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-253",
              "description": "Incorrect Check of Function Return Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T20:01:21.481Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:42922",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:42922"
        },
        {
          "name": "RHSA-2026:55855",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55855"
        },
        {
          "name": "RHSA-2026:62217",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:62217"
        },
        {
          "name": "RHSA-2026:62218",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:62218"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-59847"
        },
        {
          "name": "RHBZ#2498180",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498180"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-29T10:03:47.442Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-07-21T13:02:11.381Z",
          "value": "Made public."
        }
      ],
      "title": "Libssh: libssh: integrity downgrade via openssl aes-gcm tag verification",
      "workarounds": [
        {
          "lang": "en",
          "value": "Disable the aes128-gcm@openssh.com and aes256-gcm@openssh.com ciphers."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-253: Incorrect Check of Function Return Value"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-59847",
    "datePublished": "2026-07-21T13:18:18.146Z",
    "dateReserved": "2026-07-07T15:40:24.561Z",
    "dateUpdated": "2026-09-01T20:01:21.481Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59848 (GCVE-0-2026-59848)

Vulnerability from cvelistv5 – Published: 2026-07-21 13:21 – Updated: 2026-09-01 20:01

Title

Libssh: libssh: denial of service via sftp responses with unknown request ids

Summary

A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-23 14:28 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

redhat redhat root

References

6 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:42922	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55855	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62217	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62218	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-59848	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2498181	issue-trackingx_refsource_REDHAT

Impacted products

4 products

Vendor	Product	Version
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:0.12.0-3.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:0.9.6-17.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream cpe:/o:redhat:enterprise_linux:8::baseos
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:0.10.4-19.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream cpe:/o:redhat:enterprise_linux:9::baseos
Red Hat	Red Hat Hardened Images	Unaffected: 0.12.1-4.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1

Date Public

2026-07-21 13:18

Credits

Red Hat would like to thank Aisle Research for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59848",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-23T14:28:25.543981Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-23T14:28:28.830Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.2"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.12.0-3.el10_2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.9.6-17.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.9.6-17.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.10.4-19.el9_8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.10.4-19.el9_8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh-main",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0.12.1-4.hum1",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Aisle Research for reporting this issue."
        }
      ],
      "datePublic": "2026-07-21T13:18:03.060Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T20:01:22.011Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:42922",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:42922"
        },
        {
          "name": "RHSA-2026:55855",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55855"
        },
        {
          "name": "RHSA-2026:62217",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:62217"
        },
        {
          "name": "RHSA-2026:62218",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:62218"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-59848"
        },
        {
          "name": "RHBZ#2498181",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498181"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-29T10:03:47.442Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-07-21T13:18:03.060Z",
          "value": "Made public."
        }
      ],
      "title": "Libssh: libssh: denial of service via sftp responses with unknown request ids",
      "workarounds": [
        {
          "lang": "en",
          "value": "Do not connect to untrusted SFTP servers."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-770: Allocation of Resources Without Limits or Throttling"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-59848",
    "datePublished": "2026-07-21T13:21:50.027Z",
    "dateReserved": "2026-07-07T15:40:24.561Z",
    "dateUpdated": "2026-09-01T20:01:22.011Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59850 (GCVE-0-2026-59850)

Vulnerability from cvelistv5 – Published: 2026-07-21 14:15 – Updated: 2026-09-01 20:01

Title

Libssh: libssh: use-after-free via data callbacks on closed channels

Summary

A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-21 14:47 UTC

CWE

CWE-416 - Use After Free

Assigner

redhat redhat root

References

6 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:42922	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55855	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62217	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62218	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-59850	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2498183	issue-trackingx_refsource_REDHAT

Impacted products

4 products

Vendor	Product	Version
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:0.12.0-3.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:0.9.6-17.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream cpe:/o:redhat:enterprise_linux:8::baseos
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:0.10.4-19.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream cpe:/o:redhat:enterprise_linux:9::baseos
Red Hat	Red Hat Hardened Images	Unaffected: 0.12.1-4.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1

Date Public

2026-07-21 14:08

Credits

Red Hat would like to thank Zhou Qingyang for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59850",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-21T14:47:51.208379Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-21T14:55:01.198Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.2"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.12.0-3.el10_2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.9.6-17.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.9.6-17.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.10.4-19.el9_8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.10.4-19.el9_8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh-main",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0.12.1-4.hum1",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Zhou Qingyang for reporting this issue."
        }
      ],
      "datePublic": "2026-07-21T14:08:16.749Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T20:01:27.766Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:42922",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:42922"
        },
        {
          "name": "RHSA-2026:55855",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55855"
        },
        {
          "name": "RHSA-2026:62217",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:62217"
        },
        {
          "name": "RHSA-2026:62218",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:62218"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-59850"
        },
        {
          "name": "RHBZ#2498183",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498183"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-29T10:03:47.442Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-07-21T14:08:16.749Z",
          "value": "Made public."
        }
      ],
      "title": "Libssh: libssh: use-after-free via data callbacks on closed channels",
      "workarounds": [
        {
          "lang": "en",
          "value": "Manually verify the channel is not closed inside your channel data callbacks."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-416: Use After Free"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-59850",
    "datePublished": "2026-07-21T14:15:58.793Z",
    "dateReserved": "2026-07-07T15:40:24.561Z",
    "dateUpdated": "2026-09-01T20:01:27.766Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

SUSE-SU-2026:23056-1

CVE-2026-3731 (GCVE-0-2026-3731)

CVE-2026-59843 (GCVE-0-2026-59843)

CVE-2026-59844 (GCVE-0-2026-59844)

CVE-2026-59845 (GCVE-0-2026-59845)

CVE-2026-59846 (GCVE-0-2026-59846)

CVE-2026-59847 (GCVE-0-2026-59847)

CVE-2026-59848 (GCVE-0-2026-59848)

CVE-2026-59850 (GCVE-0-2026-59850)

Tags

Sightings

Nomenclature