CVE-2026-59843
published 2026-07-21CVE-2026-59843: A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later channel writes to loop…
PriorityP337medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.73%
53.1th percentile
A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later channel writes to loop indefinitely and consume CPU, leading to denial of service.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| libssh | libssh | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| ubuntu | libssh | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_ubuntu7.3HIGH
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
libssh vulnerabilities
vendor_ubuntu·2026-08-31·CVSS 7.3
CVE-2026-59846 [HIGH] libssh vulnerabilities
Title: libssh vulnerabilities
Summary: Several security issues were fixed in libssh.
It was discovered that libssh had a stack buffer overflow in its SFTP
server when constructing directory listing entries for long filenames. An
attacker could possibly use this issue to cause libssh to crash or execute
arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-15370)
It was discovered that libssh did not correctly handle SSH channel open
messages advertising a zero maximum packet size. An authenticated remote
attacker could possibly use this issue to cause libssh to consume excessive
CPU resources, leading to a denial of service. (CVE-2026-59843)
It was discovered that libssh did not correctly limit SFTP read request
lengths in its server implementation. An authenticated remo
Red Hat
libssh: libssh: denial of service via zero advertised channel packet size
vendor_redhat·2026-07-21·CVSS 6.5
CVE-2026-59843 [MEDIUM] libssh: libssh: denial of service via zero advertised channel packet size
libssh: libssh: denial of service via zero advertised channel packet size
A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later channel writes to loop indefinitely and consume CPU, leading to denial of service.
Mitigation: No workaround available.
Package: libssh (Red Hat Enterprise Linux 10) - Fix deferred
Package: libssh (Red Hat Enterprise Linux 8) - Fix deferred
Package: libssh (Red Hat Enterprise Linux 9) - Fix deferred
Package: libssh (Red Hat Hardened Images) - Affected
GHSA
A flaw was found in libssh.
ghsa_unreviewed·2026-07-21
CVE-2026-59843 [MEDIUM] CWE-400 A flaw was found in libssh.
A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later channel writes to loop indefinitely and consume CPU, leading to denial of service.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-59843 libssh: libssh: denial of service via zero advertised channel packet size [fedora-all]
bugzilla·2026-07-21·CVSS 6.5
CVE-2026-59843 [MEDIUM] CVE-2026-59843 libssh: libssh: denial of service via zero advertised channel packet size [fedora-all]
CVE-2026-59843 libssh: libssh: denial of service via zero advertised channel packet size [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in libssh channel handling. In ssh_packet_channel_open() in src/messages.c and ssh_packet_channel_open_conf() in src/channels.c, the implementation accepts a peer-controlled maximum packet size of 0 in channel open messages. That zero value is stored in channel state and later reaches channel_write_common(), where forward progress depends on the remote maximum packet size being positive; with 0, the remaining length is never reduced and the write path
Bugzilla
CVE-2026-59843 libssh: libssh: denial of service via zero advertised channel packet size
bugzilla·2026-07-08·CVSS 6.5
CVE-2026-59843 [MEDIUM] CVE-2026-59843 libssh: libssh: denial of service via zero advertised channel packet size
CVE-2026-59843 libssh: libssh: denial of service via zero advertised channel packet size
A flaw was found in libssh channel handling. In ssh_packet_channel_open() in src/messages.c and ssh_packet_channel_open_conf() in src/channels.c, the implementation accepts a peer-controlled maximum packet size of 0 in channel open messages. That zero value is stored in channel state and later reaches channel_write_common(), where forward progress depends on the remote maximum packet size being positive; with 0, the remaining length is never reduced and the write path loops indefinitely, consuming CPU and causing denial of service. A remote authenticated peer can trigger this by advertising a zero maximum packet size in SSH_MSG_CHANNEL_OPEN or SSH_MSG_CHANNEL_OPEN_CONFIRMATION.
2026-07-21
Published