Vulnerability-Lookup

RHSA-2026:42922

Vulnerability from csaf_redhat - Published: 2026-07-21 16:32 - Updated: 2026-07-22 19:07

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Severity

Important

Notes

Topic: An update for Red Hat Hardened Images RPMs is now available.

Details: This update includes the following RPMs: libssh: * libssh-0.12.1-4.hum1 (aarch64, x86_64) * libssh-config-0.12.1-4.hum1 (noarch) * libssh-devel-0.12.1-4.hum1 (aarch64, x86_64) * libssh-0.12.1-4.hum1.src (src)

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-59842

A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length is copied without proper length validation, leading to an out-of-bounds heap read. This could allow a remote unauthenticated attacker to disclose small amounts of server memory.

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-125 - Out-of-bounds Read

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:libssh-main@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:libssh-main@noarch	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:libssh-main@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:libssh-main@x86_64	—	Vendor Fix fix Workaround

Threats

Impact Low

CVE-2026-59843

A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later channel writes to loop indefinitely and consume CPU, leading to denial of service.

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:libssh-main@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:libssh-main@noarch	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:libssh-main@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:libssh-main@x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-59844

A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests.

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-789 - Memory Allocation with Excessive Size Value

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:libssh-main@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:libssh-main@noarch	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:libssh-main@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:libssh-main@x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-59845

A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service.

5.3 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:libssh-main@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:libssh-main@noarch	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:libssh-main@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:libssh-main@x86_64	—	Vendor Fix fix Workaround

Threats

Impact Low

CVE-2026-59846

A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.

3.9 (Low)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:libssh-main@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:libssh-main@noarch	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:libssh-main@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:libssh-main@x86_64	—	Vendor Fix fix Workaround

Threats

Impact Low

CVE-2026-59847

A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection.

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:libssh-main@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:libssh-main@noarch	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:libssh-main@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:libssh-main@x86_64	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-59848

A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service.

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:libssh-main@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:libssh-main@noarch	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:libssh-main@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:libssh-main@x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-59849

A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when configured certificates are missing or repeatedly rejected by a server, leading to denial of service.

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:libssh-main@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:libssh-main@noarch	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:libssh-main@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:libssh-main@x86_64	—	Vendor Fix fix Workaround

Threats

Impact Low

CVE-2026-59850

A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions.

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CWE-416 - Use After Free

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:libssh-main@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:libssh-main@noarch	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:libssh-main@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:libssh-main@x86_64	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-59851

A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-863 - Incorrect Authorization

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:libssh-main@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:libssh-main@noarch	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:libssh-main@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:libssh-main@x86_64	—	Vendor Fix fix Workaround

Threats

Impact Important

References

54 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:42922	self
https://images.redhat.com/	external
https://access.redhat.com/security/cve/CVE-2026-59849	external
https://access.redhat.com/security/updates/classi…	external
https://access.redhat.com/security/cve/CVE-2026-59848	external
https://access.redhat.com/security/cve/CVE-2026-59846	external
https://access.redhat.com/security/cve/CVE-2026-59845	external
https://access.redhat.com/security/cve/CVE-2026-59844	external
https://access.redhat.com/security/cve/CVE-2026-59843	external
https://access.redhat.com/security/cve/CVE-2026-59842	external
https://access.redhat.com/security/cve/CVE-2026-59851	external
https://access.redhat.com/security/cve/CVE-2026-59850	external
https://access.redhat.com/security/cve/CVE-2026-59847	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-59842	self
https://bugzilla.redhat.com/show_bug.cgi?id=2498168	external
https://www.cve.org/CVERecord?id=CVE-2026-59842	external
https://nvd.nist.gov/vuln/detail/CVE-2026-59842	external
https://access.redhat.com/security/cve/CVE-2026-59843	self
https://bugzilla.redhat.com/show_bug.cgi?id=2498176	external
https://www.cve.org/CVERecord?id=CVE-2026-59843	external
https://nvd.nist.gov/vuln/detail/CVE-2026-59843	external
https://access.redhat.com/security/cve/CVE-2026-59844	self
https://bugzilla.redhat.com/show_bug.cgi?id=2498177	external
https://www.cve.org/CVERecord?id=CVE-2026-59844	external
https://nvd.nist.gov/vuln/detail/CVE-2026-59844	external
https://access.redhat.com/security/cve/CVE-2026-59845	self
https://bugzilla.redhat.com/show_bug.cgi?id=2498178	external
https://www.cve.org/CVERecord?id=CVE-2026-59845	external
https://nvd.nist.gov/vuln/detail/CVE-2026-59845	external
https://access.redhat.com/security/cve/CVE-2026-59846	self
https://bugzilla.redhat.com/show_bug.cgi?id=2498179	external
https://www.cve.org/CVERecord?id=CVE-2026-59846	external
https://nvd.nist.gov/vuln/detail/CVE-2026-59846	external
https://access.redhat.com/security/cve/CVE-2026-59847	self
https://bugzilla.redhat.com/show_bug.cgi?id=2498180	external
https://www.cve.org/CVERecord?id=CVE-2026-59847	external
https://nvd.nist.gov/vuln/detail/CVE-2026-59847	external
https://access.redhat.com/security/cve/CVE-2026-59848	self
https://bugzilla.redhat.com/show_bug.cgi?id=2498181	external
https://www.cve.org/CVERecord?id=CVE-2026-59848	external
https://nvd.nist.gov/vuln/detail/CVE-2026-59848	external
https://access.redhat.com/security/cve/CVE-2026-59849	self
https://bugzilla.redhat.com/show_bug.cgi?id=2498182	external
https://www.cve.org/CVERecord?id=CVE-2026-59849	external
https://nvd.nist.gov/vuln/detail/CVE-2026-59849	external
https://access.redhat.com/security/cve/CVE-2026-59850	self
https://bugzilla.redhat.com/show_bug.cgi?id=2498183	external
https://www.cve.org/CVERecord?id=CVE-2026-59850	external
https://nvd.nist.gov/vuln/detail/CVE-2026-59850	external
https://access.redhat.com/security/cve/CVE-2026-59851	self
https://bugzilla.redhat.com/show_bug.cgi?id=2498184	external
https://www.cve.org/CVERecord?id=CVE-2026-59851	external
https://nvd.nist.gov/vuln/detail/CVE-2026-59851	external

Acknowledgments

nevv Yi Lin Haruki Oyama

Rinku Das Yi Lin Haruto Kimura

Chanho Kim

Halil Oktay (oblivionsage)

Saransh Rana Mikhail Ilin

Ben Smyth

Aisle Research

AISLE Research

Zhou Qingyang

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\nlibssh:\n  * libssh-0.12.1-4.hum1 (aarch64, x86_64)\n  * libssh-config-0.12.1-4.hum1 (noarch)\n  * libssh-devel-0.12.1-4.hum1 (aarch64, x86_64)\n  * libssh-0.12.1-4.hum1.src (src)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:42922",
        "url": "https://access.redhat.com/errata/RHSA-2026:42922"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59849",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59849"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59848",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59848"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59846",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59846"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59845",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59845"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59844",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59844"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59843",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59843"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59842",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59842"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59851",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59851"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59850",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59850"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59847",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59847"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_42922.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-07-22T19:07:14+00:00",
      "generator": {
        "date": "2026-07-22T19:07:14+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.7"
        }
      },
      "id": "RHSA-2026:42922",
      "initial_release_date": "2026-07-21T16:32:37+00:00",
      "revision_history": [
        {
          "date": "2026-07-21T16:32:37+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-07-22T18:52:25+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-07-22T19:07:14+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libssh-main@aarch64",
                "product": {
                  "name": "libssh-main@aarch64",
                  "product_id": "libssh-main@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libssh@0.12.1-4.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libssh-main@src",
                "product": {
                  "name": "libssh-main@src",
                  "product_id": "libssh-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libssh@0.12.1-4.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libssh-main@x86_64",
                "product": {
                  "name": "libssh-main@x86_64",
                  "product_id": "libssh-main@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libssh@0.12.1-4.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libssh-main@noarch",
                "product": {
                  "name": "libssh-main@noarch",
                  "product_id": "libssh-main@noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libssh-config@0.12.1-4.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libssh-main@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:libssh-main@aarch64"
        },
        "product_reference": "libssh-main@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libssh-main@noarch as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:libssh-main@noarch"
        },
        "product_reference": "libssh-main@noarch",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libssh-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:libssh-main@src"
        },
        "product_reference": "libssh-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libssh-main@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:libssh-main@x86_64"
        },
        "product_reference": "libssh-main@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "nevv",
            "Yi Lin",
            "Haruki Oyama"
          ]
        }
      ],
      "cve": "CVE-2026-59842",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-04-29T10:03:47.442000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498168"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length is copied without proper length validation, leading to an out-of-bounds heap read. This could allow a remote unauthenticated attacker to disclose small amounts of server memory.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libssh: libssh: information disclosure via short GSSAPI Curve25519 public key",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:libssh-main@aarch64",
          "Red Hat Hardened Images:libssh-main@noarch",
          "Red Hat Hardened Images:libssh-main@src",
          "Red Hat Hardened Images:libssh-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59842"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498168",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498168"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59842",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59842"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59842",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59842"
        }
      ],
      "release_date": "2026-07-21T11:03:52.936000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-21T16:32:37+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:42922"
        },
        {
          "category": "workaround",
          "details": "Disable GSSAPIKeyExchange or remove gss-curve25519-sha256- from GSSAPIKexAlgorithms if appropriate.",
          "product_ids": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "libssh: libssh: information disclosure via short GSSAPI Curve25519 public key"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Rinku Das",
            "Yi Lin",
            "Haruto Kimura"
          ]
        }
      ],
      "cve": "CVE-2026-59843",
      "discovery_date": "2026-04-29T10:03:47.442000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498176"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later channel writes to loop indefinitely and consume CPU, leading to denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libssh: libssh: denial of service via zero advertised channel packet size",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:libssh-main@aarch64",
          "Red Hat Hardened Images:libssh-main@noarch",
          "Red Hat Hardened Images:libssh-main@src",
          "Red Hat Hardened Images:libssh-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59843"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498176",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498176"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59843",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59843"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59843",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59843"
        }
      ],
      "release_date": "2026-07-21T11:07:00.776000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-21T16:32:37+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:42922"
        },
        {
          "category": "workaround",
          "details": "No workaround available.",
          "product_ids": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libssh: libssh: denial of service via zero advertised channel packet size"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Chanho Kim"
          ]
        }
      ],
      "cve": "CVE-2026-59844",
      "cwe": {
        "id": "CWE-789",
        "name": "Memory Allocation with Excessive Size Value"
      },
      "discovery_date": "2026-04-29T10:03:47.442000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498177"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libssh: libssh: denial of service via oversized SFTP read length",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:libssh-main@aarch64",
          "Red Hat Hardened Images:libssh-main@noarch",
          "Red Hat Hardened Images:libssh-main@src",
          "Red Hat Hardened Images:libssh-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59844"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498177",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498177"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59844",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59844"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59844",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59844"
        }
      ],
      "release_date": "2026-07-21T11:17:49.367000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-21T16:32:37+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:42922"
        },
        {
          "category": "workaround",
          "details": "No workaround available.",
          "product_ids": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libssh: libssh: denial of service via oversized SFTP read length"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Halil Oktay (oblivionsage)"
          ]
        }
      ],
      "cve": "CVE-2026-59845",
      "discovery_date": "2026-04-29T10:03:47.442000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498178"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller\u0027s accessible process tree, leading to local denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libssh: libssh: denial of service via unchecked ProxyCommand fork() failure",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate flaw in libssh client-side ProxyCommand handling can lead to a local denial of service. When ProxyCommand is configured, an unchecked fork() failure may result in signals being sent across the process tree, disrupting local system availability. This issue specifically impacts environments utilizing ProxyCommand functionality.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:libssh-main@aarch64",
          "Red Hat Hardened Images:libssh-main@noarch",
          "Red Hat Hardened Images:libssh-main@src",
          "Red Hat Hardened Images:libssh-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59845"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498178",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498178"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59845",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59845"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59845",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59845"
        }
      ],
      "release_date": "2026-07-21T11:23:44.480000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-21T16:32:37+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:42922"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, avoid using the ProxyCommand feature in libssh client configurations. This prevents the vulnerable code path from being exercised, thereby eliminating the risk of local denial of service due to unchecked fork() failures.",
          "product_ids": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "libssh: libssh: denial of service via unchecked ProxyCommand fork() failure"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Saransh Rana",
            "Mikhail Ilin"
          ]
        }
      ],
      "cve": "CVE-2026-59846",
      "discovery_date": "2026-04-29T10:03:47.442000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498179"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libssh: libssh: information disclosure via ProxyCommand %r username expansion",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:libssh-main@aarch64",
          "Red Hat Hardened Images:libssh-main@noarch",
          "Red Hat Hardened Images:libssh-main@src",
          "Red Hat Hardened Images:libssh-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59846"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498179",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498179"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59846",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59846"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59846",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59846"
        }
      ],
      "release_date": "2026-07-21T12:46:04.558000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-21T16:32:37+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:42922"
        },
        {
          "category": "workaround",
          "details": "Make sure you are not executing connections with untrusted username inputs.",
          "product_ids": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.9,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "libssh: libssh: information disclosure via ProxyCommand %r username expansion"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Ben Smyth"
          ]
        }
      ],
      "cve": "CVE-2026-59847",
      "discovery_date": "2026-04-29T10:03:47.442000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498180"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libssh: libssh: integrity downgrade via OpenSSL AES-GCM tag verification",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:libssh-main@aarch64",
          "Red Hat Hardened Images:libssh-main@noarch",
          "Red Hat Hardened Images:libssh-main@src",
          "Red Hat Hardened Images:libssh-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59847"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498180",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498180"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59847",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59847"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59847",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59847"
        }
      ],
      "release_date": "2026-07-21T13:02:11.381000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-21T16:32:37+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:42922"
        },
        {
          "category": "workaround",
          "details": "Disable the aes128-gcm@openssh.com and aes256-gcm@openssh.com ciphers.",
          "product_ids": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libssh: libssh: integrity downgrade via OpenSSL AES-GCM tag verification"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Aisle Research"
          ]
        }
      ],
      "cve": "CVE-2026-59848",
      "discovery_date": "2026-04-29T10:03:47.442000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498181"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libssh: libssh: denial of service via SFTP responses with unknown request IDs",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:libssh-main@aarch64",
          "Red Hat Hardened Images:libssh-main@noarch",
          "Red Hat Hardened Images:libssh-main@src",
          "Red Hat Hardened Images:libssh-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59848"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498181",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498181"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59848",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59848"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59848",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59848"
        }
      ],
      "release_date": "2026-07-21T13:18:03.060000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-21T16:32:37+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:42922"
        },
        {
          "category": "workaround",
          "details": "Do not connect to untrusted SFTP servers.",
          "product_ids": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libssh: libssh: denial of service via SFTP responses with unknown request IDs"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "AISLE Research"
          ]
        }
      ],
      "cve": "CVE-2026-59849",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2026-04-29T10:03:47.442000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498182"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when configured certificates are missing or repeatedly rejected by a server, leading to denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libssh: libssh: denial of service via automatic certificate authentication loop",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:libssh-main@aarch64",
          "Red Hat Hardened Images:libssh-main@noarch",
          "Red Hat Hardened Images:libssh-main@src",
          "Red Hat Hardened Images:libssh-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59849"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498182",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498182"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59849",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59849"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59849",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59849"
        }
      ],
      "release_date": "2026-07-21T14:03:21.506000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-21T16:32:37+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:42922"
        },
        {
          "category": "workaround",
          "details": "Do not connect to untrusted SSH servers and do not use certificates until patched.",
          "product_ids": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "libssh: libssh: denial of service via automatic certificate authentication loop"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Zhou Qingyang"
          ]
        }
      ],
      "cve": "CVE-2026-59850",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "discovery_date": "2026-04-29T10:03:47.442000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498183"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libssh: libssh: use-after-free via data callbacks on closed channels",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:libssh-main@aarch64",
          "Red Hat Hardened Images:libssh-main@noarch",
          "Red Hat Hardened Images:libssh-main@src",
          "Red Hat Hardened Images:libssh-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59850"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498183",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498183"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59850",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59850"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59850",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59850"
        }
      ],
      "release_date": "2026-07-21T14:08:16.749000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-21T16:32:37+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:42922"
        },
        {
          "category": "workaround",
          "details": "Manually verify the channel is not closed inside your channel data callbacks.",
          "product_ids": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libssh: libssh: use-after-free via data callbacks on closed channels"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Aisle Research"
          ]
        }
      ],
      "cve": "CVE-2026-59851",
      "cwe": {
        "id": "CWE-863",
        "name": "Incorrect Authorization"
      },
      "discovery_date": "2026-04-29T10:03:47.442000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498184"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libssh: libssh: authentication bypass via missing GSSAPI principal check",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:libssh-main@aarch64",
          "Red Hat Hardened Images:libssh-main@noarch",
          "Red Hat Hardened Images:libssh-main@src",
          "Red Hat Hardened Images:libssh-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59851"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498184",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498184"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59851",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59851"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59851",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59851"
        }
      ],
      "release_date": "2026-07-21T14:14:14.431000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-21T16:32:37+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:42922"
        },
        {
          "category": "workaround",
          "details": "Disable GSSAPIKeyExchange.",
          "product_ids": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libssh: libssh: authentication bypass via missing GSSAPI principal check"
    }
  ]
}

CVE-2026-59842 (GCVE-0-2026-59842)

Vulnerability from cvelistv5 – Published: 2026-07-21 11:08 – Updated: 2026-07-22 19:07

Title

Libssh: libssh: information disclosure via short gssapi curve25519 public key

Summary

Severity

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-125 - Out-of-bounds Read

Assigner

redhat

References

3 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:42922	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-59842	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2498168	issue-trackingx_refsource_REDHAT

Impacted products

4 products

Vendor	Product	Version
Red Hat	Red Hat Hardened Images	Unaffected: 0.12.1-4.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Date Public

2026-07-21 11:03

Credits

Red Hat would like to thank Haruki Oyama, Yi Lin, and nevv for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59842",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T14:00:56.434429Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-22T14:01:10.193Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh-main",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0.12.1-4.hum1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "unaffected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "unaffected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Haruki Oyama, Yi Lin, and nevv for reporting this issue."
        }
      ],
      "datePublic": "2026-07-21T11:03:52.936Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length is copied without proper length validation, leading to an out-of-bounds heap read. This could allow a remote unauthenticated attacker to disclose small amounts of server memory."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Low"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-22T19:07:19.005Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:42922",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:42922"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-59842"
        },
        {
          "name": "RHBZ#2498168",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498168"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-29T10:03:47.442Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-07-21T11:03:52.936Z",
          "value": "Made public."
        }
      ],
      "title": "Libssh: libssh: information disclosure via short gssapi curve25519 public key",
      "workarounds": [
        {
          "lang": "en",
          "value": "Disable GSSAPIKeyExchange or remove gss-curve25519-sha256- from GSSAPIKexAlgorithms if appropriate."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-125: Out-of-bounds Read"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-59842",
    "datePublished": "2026-07-21T11:08:30.540Z",
    "dateReserved": "2026-07-07T15:40:24.560Z",
    "dateUpdated": "2026-07-22T19:07:19.005Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59843 (GCVE-0-2026-59843)

Vulnerability from cvelistv5 – Published: 2026-07-21 11:16 – Updated: 2026-07-22 19:07

Title

Libssh: libssh: denial of service via zero advertised channel packet size

Summary

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

redhat

References

3 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:42922	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-59843	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2498176	issue-trackingx_refsource_REDHAT

Impacted products

4 products

Vendor	Product	Version
Red Hat	Red Hat Hardened Images	Unaffected: 0.12.1-4.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Date Public

2026-07-21 11:07

Credits

Red Hat would like to thank Haruto Kimura, Rinku Das, and Yi Lin for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59843",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-21T12:08:16.810909Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-21T12:08:28.113Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh-main",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0.12.1-4.hum1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Haruto Kimura, Rinku Das, and Yi Lin for reporting this issue."
        }
      ],
      "datePublic": "2026-07-21T11:07:00.776Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later channel writes to loop indefinitely and consume CPU, leading to denial of service."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-22T19:07:08.289Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:42922",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:42922"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-59843"
        },
        {
          "name": "RHBZ#2498176",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498176"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-29T10:03:47.442Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-07-21T11:07:00.776Z",
          "value": "Made public."
        }
      ],
      "title": "Libssh: libssh: denial of service via zero advertised channel packet size",
      "workarounds": [
        {
          "lang": "en",
          "value": "No workaround available."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-59843",
    "datePublished": "2026-07-21T11:16:12.061Z",
    "dateReserved": "2026-07-07T15:40:24.561Z",
    "dateUpdated": "2026-07-22T19:07:08.289Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59844 (GCVE-0-2026-59844)

Vulnerability from cvelistv5 – Published: 2026-07-21 11:32 – Updated: 2026-07-22 19:07

Title

Libssh: libssh: denial of service via oversized sftp read length

Summary

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-789 - Memory Allocation with Excessive Size Value

Assigner

redhat

References

3 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:42922	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-59844	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2498177	issue-trackingx_refsource_REDHAT

Impacted products

5 products

Vendor	Product	Version
Red Hat	Red Hat Hardened Images	Unaffected: 0.12.1-4.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Date Public

2026-07-21 11:17

Credits

Red Hat would like to thank Chanho Kim for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59844",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-21T13:11:22.542338Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-21T14:55:29.675Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh-main",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0.12.1-4.hum1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "unknown",
          "packageName": "libssh2",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Chanho Kim for reporting this issue."
        }
      ],
      "datePublic": "2026-07-21T11:17:49.367Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-789",
              "description": "Memory Allocation with Excessive Size Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-22T19:07:10.508Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:42922",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:42922"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-59844"
        },
        {
          "name": "RHBZ#2498177",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498177"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-29T10:03:47.442Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-07-21T11:17:49.367Z",
          "value": "Made public."
        }
      ],
      "title": "Libssh: libssh: denial of service via oversized sftp read length",
      "workarounds": [
        {
          "lang": "en",
          "value": "No workaround available."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-789: Memory Allocation with Excessive Size Value"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-59844",
    "datePublished": "2026-07-21T11:32:16.816Z",
    "dateReserved": "2026-07-07T15:40:24.561Z",
    "dateUpdated": "2026-07-22T19:07:10.508Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59845 (GCVE-0-2026-59845)

Vulnerability from cvelistv5 – Published: 2026-07-21 11:26 – Updated: 2026-07-22 19:07

Title

Libssh: libssh: denial of service via unchecked proxycommand fork() failure

Summary

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H

Assigner

redhat

References

3 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:42922	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-59845	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2498178	issue-trackingx_refsource_REDHAT

Impacted products

4 products

Vendor	Product	Version
Red Hat	Red Hat Hardened Images	Unaffected: 0.12.1-4.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Date Public

2026-07-21 11:23

Credits

Red Hat would like to thank Halil Oktay (oblivionsage) for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh-main",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0.12.1-4.hum1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Halil Oktay (oblivionsage) for reporting this issue."
        }
      ],
      "datePublic": "2026-07-21T11:23:44.480Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller\u0027s accessible process tree, leading to local denial of service."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-22T19:07:11.067Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:42922",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:42922"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-59845"
        },
        {
          "name": "RHBZ#2498178",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498178"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-29T10:03:47.442Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-07-21T11:23:44.480Z",
          "value": "Made public."
        }
      ],
      "title": "Libssh: libssh: denial of service via unchecked proxycommand fork() failure",
      "workarounds": [
        {
          "lang": "en",
          "value": "To mitigate this issue, avoid using the ProxyCommand feature in libssh client configurations. This prevents the vulnerable code path from being exercised, thereby eliminating the risk of local denial of service due to unchecked fork() failures."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-59845",
    "datePublished": "2026-07-21T11:26:43.884Z",
    "dateReserved": "2026-07-07T15:40:24.561Z",
    "dateUpdated": "2026-07-22T19:07:11.067Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59846 (GCVE-0-2026-59846)

Vulnerability from cvelistv5 – Published: 2026-07-21 12:55 – Updated: 2026-07-22 19:07

Title

Libssh: libssh: information disclosure via proxycommand %r username expansion

Summary

A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.

Severity

3.9 (Low)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

Assigner

redhat

References

3 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:42922	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-59846	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2498179	issue-trackingx_refsource_REDHAT

Impacted products

4 products

Vendor	Product	Version
Red Hat	Red Hat Hardened Images	Unaffected: 0.12.1-4.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Date Public

2026-07-21 12:46

Credits

Red Hat would like to thank Mikhail Ilin and Saransh Rana for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59846",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T14:03:12.267428Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-22T14:03:23.604Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh-main",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0.12.1-4.hum1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Mikhail Ilin and Saransh Rana for reporting this issue."
        }
      ],
      "datePublic": "2026-07-21T12:46:04.558Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Low"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.9,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-22T19:07:20.384Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:42922",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:42922"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-59846"
        },
        {
          "name": "RHBZ#2498179",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498179"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-29T10:03:47.442Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-07-21T12:46:04.558Z",
          "value": "Made public."
        }
      ],
      "title": "Libssh: libssh: information disclosure via proxycommand %r username expansion",
      "workarounds": [
        {
          "lang": "en",
          "value": "Make sure you are not executing connections with untrusted username inputs."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-59846",
    "datePublished": "2026-07-21T12:55:56.532Z",
    "dateReserved": "2026-07-07T15:40:24.561Z",
    "dateUpdated": "2026-07-22T19:07:20.384Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59847 (GCVE-0-2026-59847)

Vulnerability from cvelistv5 – Published: 2026-07-21 13:18 – Updated: 2026-07-22 19:07

Title

Libssh: libssh: integrity downgrade via openssl aes-gcm tag verification

Summary

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-1310 - Missing Ability to Patch ROM Code

Assigner

redhat

References

3 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:42922	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-59847	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2498180	issue-trackingx_refsource_REDHAT

Impacted products

4 products

Vendor	Product	Version
Red Hat	Red Hat Hardened Images	Unaffected: 0.12.1-4.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Date Public

2026-07-21 13:02

Credits

Red Hat would like to thank Ben Smyth for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59847",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-21T14:03:33.644166Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-1310",
                "description": "CWE-1310 Missing Ability to Patch ROM Code",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-21T14:06:22.692Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh-main",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0.12.1-4.hum1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Ben Smyth for reporting this issue."
        }
      ],
      "datePublic": "2026-07-21T13:02:11.381Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-22T19:07:12.443Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:42922",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:42922"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-59847"
        },
        {
          "name": "RHBZ#2498180",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498180"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-29T10:03:47.442Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-07-21T13:02:11.381Z",
          "value": "Made public."
        }
      ],
      "title": "Libssh: libssh: integrity downgrade via openssl aes-gcm tag verification",
      "workarounds": [
        {
          "lang": "en",
          "value": "Disable the aes128-gcm@openssh.com and aes256-gcm@openssh.com ciphers."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-59847",
    "datePublished": "2026-07-21T13:18:18.146Z",
    "dateReserved": "2026-07-07T15:40:24.561Z",
    "dateUpdated": "2026-07-22T19:07:12.443Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59848 (GCVE-0-2026-59848)

Vulnerability from cvelistv5 – Published: 2026-07-21 13:21 – Updated: 2026-07-22 19:07

Title

Libssh: libssh: denial of service via sftp responses with unknown request ids

Summary

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Assigner

redhat

References

3 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:42922	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-59848	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2498181	issue-trackingx_refsource_REDHAT

Impacted products

4 products

Vendor	Product	Version
Red Hat	Red Hat Hardened Images	Unaffected: 0.12.1-4.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Date Public

2026-07-21 13:18

Credits

Red Hat would like to thank Aisle Research for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh-main",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0.12.1-4.hum1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Aisle Research for reporting this issue."
        }
      ],
      "datePublic": "2026-07-21T13:18:03.060Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-22T19:07:14.297Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:42922",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:42922"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-59848"
        },
        {
          "name": "RHBZ#2498181",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498181"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-29T10:03:47.442Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-07-21T13:18:03.060Z",
          "value": "Made public."
        }
      ],
      "title": "Libssh: libssh: denial of service via sftp responses with unknown request ids",
      "workarounds": [
        {
          "lang": "en",
          "value": "Do not connect to untrusted SFTP servers."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-59848",
    "datePublished": "2026-07-21T13:21:50.027Z",
    "dateReserved": "2026-07-07T15:40:24.561Z",
    "dateUpdated": "2026-07-22T19:07:14.297Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59849 (GCVE-0-2026-59849)

Vulnerability from cvelistv5 – Published: 2026-07-21 14:08 – Updated: 2026-07-22 19:07

Title

Libssh: libssh: denial of service via automatic certificate authentication loop

Summary

Severity

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Assigner

redhat

References

3 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:42922	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-59849	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2498182	issue-trackingx_refsource_REDHAT

Impacted products

4 products

Vendor	Product	Version
Red Hat	Red Hat Hardened Images	Unaffected: 0.12.1-4.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Date Public

2026-07-21 14:03

Credits

Red Hat would like to thank AISLE Research for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59849",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T14:31:02.938864Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-22T14:31:13.977Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh-main",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0.12.1-4.hum1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "unaffected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "unaffected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank AISLE Research for reporting this issue."
        }
      ],
      "datePublic": "2026-07-21T14:03:21.506Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when configured certificates are missing or repeatedly rejected by a server, leading to denial of service."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Low"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-835",
              "description": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-22T19:07:23.331Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:42922",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:42922"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-59849"
        },
        {
          "name": "RHBZ#2498182",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498182"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-29T10:03:47.442Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-07-21T14:03:21.506Z",
          "value": "Made public."
        }
      ],
      "title": "Libssh: libssh: denial of service via automatic certificate authentication loop",
      "workarounds": [
        {
          "lang": "en",
          "value": "Do not connect to untrusted SSH servers and do not use certificates until patched."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-59849",
    "datePublished": "2026-07-21T14:08:15.016Z",
    "dateReserved": "2026-07-07T15:40:24.561Z",
    "dateUpdated": "2026-07-22T19:07:23.331Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59850 (GCVE-0-2026-59850)

Vulnerability from cvelistv5 – Published: 2026-07-21 14:15 – Updated: 2026-07-22 19:07

Title

Libssh: libssh: use-after-free via data callbacks on closed channels

Summary

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-416 - Use After Free

Assigner

redhat

References

3 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:42922	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-59850	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2498183	issue-trackingx_refsource_REDHAT

Impacted products

4 products

Vendor	Product	Version
Red Hat	Red Hat Hardened Images	Unaffected: 0.12.1-4.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Date Public

2026-07-21 14:08

Credits

Red Hat would like to thank Zhou Qingyang for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59850",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-21T14:47:51.208379Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-21T14:55:01.198Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh-main",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0.12.1-4.hum1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Zhou Qingyang for reporting this issue."
        }
      ],
      "datePublic": "2026-07-21T14:08:16.749Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-22T19:07:15.638Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:42922",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:42922"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-59850"
        },
        {
          "name": "RHBZ#2498183",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498183"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-29T10:03:47.442Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-07-21T14:08:16.749Z",
          "value": "Made public."
        }
      ],
      "title": "Libssh: libssh: use-after-free via data callbacks on closed channels",
      "workarounds": [
        {
          "lang": "en",
          "value": "Manually verify the channel is not closed inside your channel data callbacks."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-416: Use After Free"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-59850",
    "datePublished": "2026-07-21T14:15:58.793Z",
    "dateReserved": "2026-07-07T15:40:24.561Z",
    "dateUpdated": "2026-07-22T19:07:15.638Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59851 (GCVE-0-2026-59851)

Vulnerability from cvelistv5 – Published: 2026-07-21 14:20 – Updated: 2026-07-22 19:06

Title

Libssh: libssh: authentication bypass via missing gssapi principal check

Summary

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-863 - Incorrect Authorization

Assigner

redhat

References

3 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:42922	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-59851	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2498184	issue-trackingx_refsource_REDHAT

Impacted products

4 products

Vendor	Product	Version
Red Hat	Red Hat Hardened Images	Unaffected: 0.12.1-4.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Date Public

2026-07-21 14:14

Credits

Red Hat would like to thank Aisle Research for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59851",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T18:14:50.808102Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-22T18:15:44.264Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh-main",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0.12.1-4.hum1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "unaffected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "unaffected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Aisle Research for reporting this issue."
        }
      ],
      "datePublic": "2026-07-21T14:14:14.431Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-22T19:06:52.468Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:42922",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:42922"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-59851"
        },
        {
          "name": "RHBZ#2498184",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498184"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-29T10:03:47.442Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-07-21T14:14:14.431Z",
          "value": "Made public."
        }
      ],
      "title": "Libssh: libssh: authentication bypass via missing gssapi principal check",
      "workarounds": [
        {
          "lang": "en",
          "value": "Disable GSSAPIKeyExchange."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-863: Incorrect Authorization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-59851",
    "datePublished": "2026-07-21T14:20:47.001Z",
    "dateReserved": "2026-07-07T15:40:24.561Z",
    "dateUpdated": "2026-07-22T19:06:52.468Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

RHSA-2026:42922

CVE-2026-59842 (GCVE-0-2026-59842)

CVE-2026-59843 (GCVE-0-2026-59843)

CVE-2026-59844 (GCVE-0-2026-59844)

CVE-2026-59845 (GCVE-0-2026-59845)

CVE-2026-59846 (GCVE-0-2026-59846)

CVE-2026-59847 (GCVE-0-2026-59847)

CVE-2026-59848 (GCVE-0-2026-59848)

CVE-2026-59849 (GCVE-0-2026-59849)

CVE-2026-59850 (GCVE-0-2026-59850)

CVE-2026-59851 (GCVE-0-2026-59851)

Tags

Sightings

Nomenclature