Security Bulletin: Uncontrolled resource consumption, incorrect check of function return value, and other vulnerabilities might affect IBM Storage Defender - Resiliency Service

Summary IBM Storage Defender - Resiliency Service is vulnerable to uncontrolled resource consumption, incorrect check of function return value, and others. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-59843 DESCRIPTION: A flaw was found in libssh. A remote...

Unity Linux 20.1070a Security Update: libssh (UTSA-2026-130137)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130137 advisory. A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSHMSGCHANNELOPEN, causing later channel writes to loop...

EulerOS 2.0 SP11 : libssh (EulerOS-SA-2026-4340)

According to the versions of the libssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSHMSGCHANNELOPEN, causing later channel write...

EulerOS 2.0 SP13 : libssh (EulerOS-SA-2026-4064)

According to the versions of the libssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSHMSGCHANNELOPEN, causing later channel write...

EulerOS 2.0 SP11 : libssh (EulerOS-SA-2026-4249)

According to the versions of the libssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSHMSGCHANNELOPEN, causing later channel write...

EulerOS 2.0 SP13 : libssh (EulerOS-SA-2026-4155)

According to the versions of the libssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSHMSGCHANNELOPEN, causing later channel write...

PYSEC-2026-4026 AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION

Summary A malicious SSH server can wedge an AsyncSSH client, and an authenticated client can wedge an AsyncSSH server, by sending a channel maximum packet size of 0 in SSHMSGCHANNELOPENCONFIRMATION server→client or SSHMSGCHANNELOPEN client→server. AsyncSSH stores the peer-supplied value verbatim...

AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION

SummaryA malicious SSH server can wedge an AsyncSSH client, and an authenticatedclient can wedge an AsyncSSH server, by sending a channel maximum packetsize of 0 in SSHMSGCHANNELOPENCONFIRMATION server→client orSSHMSGCHANNELOPEN client→server. AsyncSSH stores the peer-supplied valueverbatim with ...

Rocky Linux 9.6 [TuxCare] Security Update: libssh / libssh-config / libssh-devel Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1786549709)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786549709 advisory. - A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSHMSGCHANNELOPEN, causing...

AlmaLinux 9.2 [TuxCare] Security Update: libssh / libssh-config / libssh-devel Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1786446507)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1786446507 advisory. - A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSHMSGCHANNELOPEN, causing lat...

AlmaLinux 9.6 [TuxCare] Security Update: libssh / libssh-config / libssh-devel Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1786549709)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786549709 advisory. - A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSHMSGCHANNELOPEN, causing lat...

EUVD-2026-89204

Russh: Unbounded memory exhaustion via CHANNELOPEN flood during a client-stalled rekey...

DEBIAN-CVE-2026-102821

Russh is a Rust SSH client and server library. Prior to 0.63.2, an authenticated remote peer can send SSHMSGKEXINIT without the required SSHMSGKEXECDHINIT and then flood SSHMSGCHANNELOPEN messages while SessionKexState::InProgress prevents priorityreceiver in russh/src/server/session.rs from bein...

CVE-2026-102821

Russh is a Rust SSH client and server library. Prior to 0.63.2, an authenticated remote peer can send SSHMSGKEXINIT without the required SSHMSGKEXECDHINIT and then flood SSHMSGCHANNELOPEN messages while SessionKexState::InProgress prevents priorityreceiver in russh/src/server/session.rs from bein...

CVE-2026-102821

Russh is a Rust SSH client and server library. Prior to 0.63.2, an authenticated remote peer can send SSHMSGKEXINIT without the required SSHMSGKEXECDHINIT and then flood SSHMSGCHANNELOPEN messages while SessionKexState::InProgress prevents priorityreceiver in russh/src/server/session.rs from bein...

UBUNTU-CVE-2026-102821

Russh is a Rust SSH client and server library. Prior to 0.63.2, an authenticated remote peer can send SSHMSGKEXINIT without the required SSHMSGKEXECDHINIT and then flood SSHMSGCHANNELOPEN messages while SessionKexState::InProgress prevents priorityreceiver in russh/src/server/session.rs from bein...

CVE-2026-102821

The Russh Rust SSH library (prior to version 0.63.2 ) is vulnerable to unbounded memory exhaustion during a client-stalled rekey. An authenticated remote peer can send SSH_MSG_KEXINIT without the required SSH_MSG_KEX_ECDH_INIT and flood SSH_MSG_CHANNEL_OPEN messages. Because SessionKexState::InPr...

CVE-2026-102821 Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey

Russh is a Rust SSH client and server library. Prior to 0.63.2, an authenticated remote peer can send SSHMSGKEXINIT without the required SSHMSGKEXECDHINIT and then flood SSHMSGCHANNELOPEN messages while SessionKexState::InProgress prevents priorityreceiver in russh/src/server/session.rs from bein...

CVE-2026-102821

Russh is a Rust SSH client and server library. Prior to 0.63.2, an authenticated remote peer can send SSHMSGKEXINIT without the required SSHMSGKEXECDHINIT and then flood SSHMSGCHANNELOPEN messages while SessionKexState::InProgress prevents priorityreceiver in russh/src/server/session.rs from bein...

CVE-2026-102821 Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey

Russh is a Rust SSH client and server library. Prior to 0.63.2, an authenticated remote peer can send SSHMSGKEXINIT without the required SSHMSGKEXECDHINIT and then flood SSHMSGCHANNELOPEN messages while SessionKexState::InProgress prevents priorityreceiver in russh/src/server/session.rs from bein...