Red Hat Security Advisory: libssh security update

Fixed packages 5

Vulnerabilities 5

• Medium 6.5
  CVE-2026-0966

  Libssh: libssh: denial of service via zero-length input in ssh_get_hexa()

  A flaw was found in libssh. The API function `ssh_get_hexa()` is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI (Generic Security Service Application Program Interface) authenti…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  Mar 26, 2026
• Medium 5.0
  CVE-2026-0964

  Libssh: improper sanitation of paths received from scp servers

  A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory. This could be misused to create malicious executable or configuration files and make the user execute them under specifi…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  Mar 26, 2026
• Low 3.3
  CVE-2026-0965

  Libssh: libssh: denial of service via improper configuration file handling

  A flaw was found in libssh where it can attempt to open arbitrary files during configuration parsing. A local attacker can exploit this by providing a malicious configuration file or when the system is misconfigured. This vulnerability could lead to a Denial …

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  Mar 26, 2026
• Low 3.1
  CVE-2026-0968

  Libssh: libssh: denial of service due to malformed sftp message

  A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an `SSH_FXP_NAME` message during a file listing operation. This missing null check can lead to reading bey…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  Mar 26, 2026
• Low 2.2
  CVE-2026-0967

  Libssh: libssh: denial of service via inefficient regular expression processing

  A flaw was found in libssh. A remote attacker, by controlling client configuration files or known_hosts files, could craft specific hostnames that when processed by the `match_pattern()` function can lead to inefficient regular expression backtracking. This c…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  Mar 26, 2026

References

• article
  https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/10.2_release_notes/index
• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2433121
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2436979
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2436980
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2436981
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2436982
• article
  https://issues.redhat.com/browse/RHEL-133421
• article
  https://issues.redhat.com/browse/RHEL-70825
• article
  https://issues.redhat.com/browse/RHEL-93748
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_18160.json
• report
  https://access.redhat.com/security/cve/CVE-2026-0964
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-0964
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-0964
• article
  https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/
• report
  https://access.redhat.com/security/cve/CVE-2026-0965
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-0965
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-0965
• report
  https://access.redhat.com/security/cve/CVE-2026-0966
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-0966
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-0966
• report
  https://access.redhat.com/security/cve/CVE-2026-0967
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-0967
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-0967
• report
  https://access.redhat.com/security/cve/CVE-2026-0968
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-0968
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-0968