CVE-2026-0966
published 2026-03-26CVE-2026-0966: A flaw was found in libssh. The API function `ssh_get_hexa()` is vulnerable to a denial of service when processing zero-length input. This can be exploited…
PriorityP347high8.2CVSS 3.1
AVNACLPRNUINSUCNILAH
EPSS
0.58%
43.9th percentile
A flaw was found in libssh. The API function `ssh_get_hexa()` is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI (Generic Security Service Application Program Interface) authentication if the server's logging verbosity is set to `SSH_LOG_PACKET (3)` or higher. Successful exploitation could lead to a self-Denial of Service of the per-connection daemon process.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | libssh | < libssh 0.12.0-1 (forky) | libssh 0.12.0-1 (forky) |
| libssh | libssh | < 0.11.4 | 0.11.4 |
| libssh | libssh | >= 0 < 0.12.0-1 | 0.12.0-1 |
| libssh | libssh | >= 0 < 0.9.6-2ubuntu0.22.04.6 | 0.9.6-2ubuntu0.22.04.6 |
| libssh | libssh | >= 0 < 0.10.6-2ubuntu0.3 | 0.10.6-2ubuntu0.3 |
| libssh | libssh | >= 0 < 0.11.2-1ubuntu0.2 | 0.11.2-1ubuntu0.2 |
| libssh | libssh | >= 0 < 0.6.3-4.3ubuntu0.6+esm4 | 0.6.3-4.3ubuntu0.6+esm4 |
| libssh | libssh | >= 0 < 0.8.0~20170825.94fa1e38-1ubuntu0.7+esm6 | 0.8.0~20170825.94fa1e38-1ubuntu0.7+esm6 |
| libssh | libssh | >= 0 < 0.9.3-2ubuntu2.5+esm3 | 0.9.3-2ubuntu2.5+esm3 |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | openshift_container_platform | — | — |
CVSS provenance
nvdv3.18.2HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
osv6.5MEDIUM
vendor_debian6.5MEDIUM
vendor_redhat6.5MEDIUM
vendor_ubuntu3.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
libssh ssh_get_hexa buffer overflow (EUVD-2026-16330 / Nessus ID 298574)
vuldb·2026-05-06·CVSS 8.2
CVE-2026-0966 [HIGH] libssh ssh_get_hexa buffer overflow (EUVD-2026-16330 / Nessus ID 298574)
A vulnerability marked as critical has been reported in libssh. The impacted element is the function ssh_get_hexa. Performing a manipulation results in buffer overflow.
This vulnerability was named CVE-2026-0966. The attack may be initiated remotely. There is no available exploit.
GHSA
GHSA-wcqf-w94x-4wg2: The API function `ssh_get_hexa()` is vulnerable, when 0-lenght
input is provided to this function
ghsa_unreviewed·2026-03-26
CVE-2026-0966 [MEDIUM] CWE-124 GHSA-wcqf-w94x-4wg2: The API function `ssh_get_hexa()` is vulnerable, when 0-lenght
input is provided to this function
The API function `ssh_get_hexa()` is vulnerable, when 0-lenght
input is provided to this function. This function is used internally
in `ssh_get_fingerprint_hash()` and `ssh_print_hexa()` (deprecated),
which is vulnerable to the same input (length is provided by the
calling application).
The function is also used internally in the gssapi code for logging
the OIDs received by the server during GSSAPI authentication. This
could be triggered remotely, when the server allows GSSAPI authentication
and logging verbosity is set at least to SSH_LOG_PACKET (3). This
could cause self-DoS of the per-connection daemon process.
OSV
CVE-2026-0966: The API function `ssh_get_hexa()` is vulnerable, when 0-lenght input is provided to this function
osv·2026-03-26·CVSS 6.5
CVE-2026-0966 [MEDIUM] CVE-2026-0966: The API function `ssh_get_hexa()` is vulnerable, when 0-lenght input is provided to this function
The API function `ssh_get_hexa()` is vulnerable, when 0-lenght input is provided to this function. This function is used internally in `ssh_get_fingerprint_hash()` and `ssh_print_hexa()` (deprecated), which is vulnerable to the same input (length is provided by the calling application). The function is also used internally in the gssapi code for logging the OIDs received by the server during GSSAPI authentication. This could be triggered remotely, when the server allows GSSAPI authentication and logging verbosity is set at least to SSH_LOG_PACKET (3). This could cause self-DoS of the per-connection daemon process.
OSV
libssh vulnerabilities
osv·2026-02-23·CVSS 3.1
CVE-2025-8277 [LOW] libssh vulnerabilities
libssh vulnerabilities
USN-8051-1 fixed vulnerabilities in libssh. This update provides the
corresponding updates for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu
20.04 LTS.
Original advisory details:
It was discovered that libssh clients incorrectly handled the key exchange
process. A remote attacker could possibly use this issue to cause libssh
clients to crash, resulting in a denial of service. (CVE-2025-8277)
It was discovered that the libssh SCP client incorrectly sanitized paths
received from servers. A remote attacker could use this issue to cause
libssh SCP clients to overwrite files outside of the working directory and
possibly execute arbitrary code. (CVE-2026-0964)
It was discovered that libssh incorrectly handled parsing configuration
files. A local attacker could possib
OSV
libssh vulnerabilities
osv·2026-02-18·CVSS 3.1
CVE-2025-8277 [LOW] libssh vulnerabilities
libssh vulnerabilities
It was discovered that libssh clients incorrectly handled the key exchange
process. A remote attacker could possibly use this issue to cause libssh
clients to crash, resulting in a denial of service. (CVE-2025-8277)
It was discovered that the libssh SCP client incorrectly sanitized paths
received from servers. A remote attacker could use this issue to cause
libssh SCP clients to overwrite files outside of the working directory and
possibly execute arbitrary code. (CVE-2026-0964)
It was discovered that libssh incorrectly handled parsing configuration
files. A local attacker could possibly use this issue to cause libssh to
access non-regular files, resulting in a denial of service. (CVE-2026-0965)
It was discovered that libssh incorrectly handled the ssh_get_hexa()
Ubuntu
libssh vulnerabilities
vendor_ubuntu·2026-02-23·CVSS 3.1
CVE-2026-0965 [LOW] libssh vulnerabilities
Title: libssh vulnerabilities
Summary: Several security issues were fixed in libssh.
USN-8051-1 fixed vulnerabilities in libssh. This update provides the
corresponding updates for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu
20.04 LTS.
Original advisory details:
It was discovered that libssh clients incorrectly handled the key exchange
process. A remote attacker could possibly use this issue to cause libssh
clients to crash, resulting in a denial of service. (CVE-2025-8277)
It was discovered that the libssh SCP client incorrectly sanitized paths
received from servers. A remote attacker could use this issue to cause
libssh SCP clients to overwrite files outside of the working directory and
possibly execute arbitrary code. (CVE-2026-0964)
It was discovered that libssh incorrectly han
Ubuntu
libssh vulnerabilities
vendor_ubuntu·2026-02-18·CVSS 3.1
CVE-2026-0965 [LOW] libssh vulnerabilities
Title: libssh vulnerabilities
Summary: Several security issues were fixed in libssh.
It was discovered that libssh clients incorrectly handled the key exchange
process. A remote attacker could possibly use this issue to cause libssh
clients to crash, resulting in a denial of service. (CVE-2025-8277)
It was discovered that the libssh SCP client incorrectly sanitized paths
received from servers. A remote attacker could use this issue to cause
libssh SCP clients to overwrite files outside of the working directory and
possibly execute arbitrary code. (CVE-2026-0964)
It was discovered that libssh incorrectly handled parsing configuration
files. A local attacker could possibly use this issue to cause libssh to
access non-regular files, resulting in a denial of service. (CVE-2026-0965)
It wa
Red Hat
libssh: Buffer underflow in ssh_get_hexa() on invalid input
vendor_redhat·2026-02-10·CVSS 6.5
CVE-2026-0966 [MEDIUM] CWE-124 libssh: Buffer underflow in ssh_get_hexa() on invalid input
libssh: Buffer underflow in ssh_get_hexa() on invalid input
The API function `ssh_get_hexa()` is vulnerable, when 0-lenght
input is provided to this function. This function is used internally
in `ssh_get_fingerprint_hash()` and `ssh_print_hexa()` (deprecated),
which is vulnerable to the same input (length is provided by the
calling application).
The function is also used internally in the gssapi code for logging
the OIDs received by the server during GSSAPI authentication. This
could be triggered remotely, when the server allows GSSAPI authentication
and logging verbosity is set at least to SSH_LOG_PACKET (3). This
could cause self-DoS of the per-connection daemon process.
The API function `ssh_get_hexa()` is vulnerable, when 0-lenght
input is provided to this function. This function is
Debian
CVE-2026-0966: libssh - The API function `ssh_get_hexa()` is vulnerable, when 0-lenght input is provided...
vendor_debian·2026·CVSS 6.5
CVE-2026-0966 [MEDIUM] CVE-2026-0966: libssh - The API function `ssh_get_hexa()` is vulnerable, when 0-lenght input is provided...
The API function `ssh_get_hexa()` is vulnerable, when 0-lenght input is provided to this function. This function is used internally in `ssh_get_fingerprint_hash()` and `ssh_print_hexa()` (deprecated), which is vulnerable to the same input (length is provided by the calling application). The function is also used internally in the gssapi code for logging the OIDs received by the server during GSSAPI authentication. This could be triggered remotely, when the server allows GSSAPI authentication and logging verbosity is set at least to SSH_LOG_PACKET (3). This could cause self-DoS of the per-connection daemon process.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 0.12.0-1)
sid: resolved (fixed in 0.12.0-1)
trixie: open
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-0966 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.5
CVE-2026-0966 [MEDIUM] CVE-2026-0966 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-0966 :
Linux Debian vulnerability analysis and mitigation
ssh_get_hexa()
ssh_get_fingerprint_hash()
ssh_print_hexa()
The function is also used internally in the gssapi code for logging
the OIDs received by the server during GSSAPI authentication. This
could be triggered remotely, when the server allows GSSAPI authentication
and logging verbosity is set at least to SSH_LOG_PACKET (3). This
could cause self-DoS of the per-connection daemon process.
Source : NVD
## 6.5
Score
Published March 26, 2026
Severity MEDIUM
CNA Score 6.5
Affected Technologies
Linux Debian
Linux Ubuntu
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 28.2
Exploitation Probability (EPSS) 0.1
Affecte
Bugzilla
CVE-2026-0966 libssh: libssh: Denial of Service via zero-length input in ssh_get_hexa()
bugzilla·2026-01-26·CVSS 8.2
CVE-2026-0966 [HIGH] CVE-2026-0966 libssh: libssh: Denial of Service via zero-length input in ssh_get_hexa()
CVE-2026-0966 libssh: libssh: Denial of Service via zero-length input in ssh_get_hexa()
The API function `ssh_get_hexa()` is vulnerable, when 0-lenght
input is provided to this function. This function is used internally
in `ssh_get_fingerprint_hash()` and `ssh_print_hexa()` (deprecated),
which is vulnerable to the same input (length is provided by the
calling application).
The function is also used internally in the gssapi code for logging
the OIDs received by the server during GSSAPI authentication. This
could be triggered remotely, when the server allows GSSAPI authentication
and logging verbosity is set at least to SSH_LOG_PACKET (3). This
could cause self-DoS of the per-connection daemon process.
https://access.redhat.com/errata/RHSA-2026:18160https://access.redhat.com/errata/RHSA-2026:18683https://access.redhat.com/errata/RHSA-2026:7067https://access.redhat.com/security/cve/CVE-2026-0966https://bugzilla.redhat.com/show_bug.cgi?id=2433121https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/
2026-03-26
Published