Red Hat Security Advisory: libssh security update

Fixed packages 7

Vulnerabilities 7

• Medium 6.5
  CVE-2026-59843

  Libssh: libssh: denial of service via zero advertised channel packet size

  A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later channel writes to loop indefinitely and consume CPU, leading to denial of service.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu Azure Linux Alpine Wolfi
  Jul 21, 2026
• Medium 6.5
  CVE-2026-59844

  Libssh: libssh: denial of service via oversized sftp read length

  A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu Azure Linux Alpine Wolfi
  Jul 21, 2026
• Medium 5.9
  CVE-2026-59847

  Libssh: libssh: integrity downgrade via openssl aes-gcm tag verification

  A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu Azure Linux Alpine Wolfi
  Jul 21, 2026
• Medium 5.3
  CVE-2026-59845

  Libssh: libssh: denial of service via unchecked proxycommand fork() failure

  A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu Azure Linux Alpine Wolfi
  Jul 21, 2026
• Medium 5.3
  CVE-2026-59848

  Libssh: libssh: denial of service via sftp responses with unknown request ids

  A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu Azure Linux Alpine Wolfi
  Jul 21, 2026
• Medium 4.3
  CVE-2026-59850

  Libssh: libssh: use-after-free via data callbacks on closed channels

  A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu Azure Linux Alpine Wolfi
  Jul 21, 2026
• Low 3.9
  CVE-2026-59846

  Libssh: libssh: information disclosure via proxycommand %r username expansion

  A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu Alpine Wolfi
  Jul 21, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2498176
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2498177
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2498178
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2498179
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2498180
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2498181
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2498183
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_62218.json
• report
  https://access.redhat.com/security/cve/CVE-2026-59843
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-59843
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-59843
• report
  https://access.redhat.com/security/cve/CVE-2026-59844
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-59844
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-59844
• report
  https://access.redhat.com/security/cve/CVE-2026-59845
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-59845
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-59845
• report
  https://access.redhat.com/security/cve/CVE-2026-59846
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-59846
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-59846
• report
  https://access.redhat.com/security/cve/CVE-2026-59847
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-59847
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-59847
• report
  https://access.redhat.com/security/cve/CVE-2026-59848
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-59848
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-59848
• report
  https://access.redhat.com/security/cve/CVE-2026-59850
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-59850
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-59850