2456 matches found
CVE-2026-59842: Out-of-bounds Read
A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length is copied without proper length validation, leading to an out-of-bounds heap read. This could allow a remote unauthenticated attacker to disclose small...
CVE-2026-59851: Incorrect Authorization
A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users...
CVE-2026-15370: Stack-based Buffer Overflow
A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list attacker-controlled filenames, sufficiently long names can overflow that stack buffer and may lead ...
CVE-2026-59845: Detection of Error Condition Without Action
A flaw was found in libssh. When ProxyCommand is used, an unchecked fork failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service...
CVE-2026-59843: Loop with Unreachable Exit Condition
A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSHMSGCHANNELOPEN, causing later channel writes to loop indefinitely and consume CPU, leading to denial of service...
CVE-2026-59848: Allocation of Resources Without Limits or Throttling
A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service...
CVE-2026-59850: Use After Free
A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions...
CVE-2026-59846: Improper Neutralization of Special Elements used in an OS Command
A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior...
PT-2026-61939
Name of the Vulnerable Software and Affected Versions libssh affected versions not specified Description Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can remove integrity protection. This allows an in-path attacker to modify plaintext during transmission without...
PT-2026-61949
Name of the Vulnerable Software and Affected Versions libssh affected versions not specified Description A flaw exists where data packets processed after a channel is closed can trigger channel data callbacks after the associated data has been freed. This can result in system crashes or...
Oracle Linux 10 : libssh (ELSA-2026-18160)
The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-18160 advisory. 0.12.0-2 - Fix the verbosity of some new logs added in 0.12.0 Resolves: RHEL-93748 0.12.0-1 - Rebase to 0.12.0 Resolves: RHEL-133421, RHEL-70825,...
Astra Linux – Vulnerability in libssh
A flaw was discovered in libssh, where a malicious SFTP SSH File Transfer Protocol server can exploit this by sending a malformed ‘longname’ field within an SSHFXPNAME message during a file listing operation. This missing null check can lead to reading beyond the allocated memory on the heap. Thi...
Astra Linux – Vulnerability in libssh
A flaw was discovered in libssh. A remote attacker, by controlling client configuration files or knownhosts files, could create specific hostnames that, when processed by the matchpattern function, could lead to inefficient regular expression backtracking. This could cause timeouts and resource...
Astra Linux – Vulnerability in libssh
A flaw was discovered in libssh. The API function sshgethexa is vulnerable to a denial-of-service attack when processing zero-length inputs. This vulnerability can be exploited remotely by an attacker during GSSAPI Generic Security Service Application Program Interface authentication, if the...
Astra Linux – Vulnerability in libssh
A malicious SCP server can send unexpected commands that may cause the client application to override local files outside of the working directory. This could be exploited to create malicious executable or configuration files, causing the user to execute them with specific consequences. This is t...
Oracle Linux 9 : libssh (ELSA-2026-18683)
The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-18683 advisory. - Resolves: CVE-2025-4877 - Resolves: CVE-2025-4878 - Resolves: CVE-2025-5351 - Resolves: CVE-2025-8114 - Resolves: CVE-2025-8277 - Resolves:...
Low: libssh
Issue Overview: libssh Possible Denial of Service when parsing unexpected configuration files CVE-2026-0965 Affected Packages: libssh Issue Correction: Run dnf update libssh --releasever 2023.12.20260622 or dnf update --advisory ALAS2023-2026-1824 --releasever 2023.12.20260622 to update your...
Amazon Linux 2023 : libssh, libssh-config, libssh-devel (ALAS2023-2026-1824)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1824 advisory. libssh Possible Denial of Service when parsing unexpected configuration files CVE-2026-0965 Tenable has extracted the preceding description block directly from the tested product security advisory. Not...
Photon OS 5.0: Libssh PHSA-2026-5.0-0782
An update of the libssh package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-0782. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...