CLSA-2026-1786448214 libssh: Fix of 2 CVEs

CVE-2026-59847: integrity downgrade of AES-GCM ciphers in the OpenSSL backend, where a wrong EVPDecryptFinal return-code check let a forged authentication tag pass and silently reduced AES-GCM to AES-CTR - CVE-2026-59850: use-after-free via channel data callbacks invoked on remotely-closed...

CLSA-2026-1786012443 libssh: Fix of 2 CVEs

CVE-2026-59847: integrity downgrade of AES-GCM ciphers in the OpenSSL backend, where a wrong EVPDecryptFinal return-code check let a forged authentication tag pass and silently reduced AES-GCM to AES-CTR - CVE-2026-59850: use-after-free via channel data callbacks invoked on remotely-closed...

CLSA-2026-1786012208 libssh: Fix of 2 CVEs

CVE-2026-59847: integrity downgrade of AES-GCM ciphers in the OpenSSL backend, where a wrong EVPDecryptFinal return-code check let a forged authentication tag pass and silently reduced AES-GCM to AES-CTR - CVE-2026-59850: use-after-free via channel data callbacks invoked on remotely-closed...

CVE-2026-59850

A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions...

CVE-2026-59850

A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions. Mitigation Manually verify the channel is not closed inside your...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free in the channel data callbacks process when data packets are processed after a channel is closed. An attacker can cause a crash or trigger unintended behavior by sending data packets to a closed channel, resulting in the...

PT-2026-61949

Name of the Vulnerable Software and Affected Versions libssh affected versions not specified Description A flaw exists where data packets processed after a channel is closed can trigger channel data callbacks after the associated data has been freed. This can result in system crashes or...