CVE-2026-59845
published 2026-07-21CVE-2026-59845: A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent…
PriorityP421medium5.9CVSS 3.1
AVLACLPRLUIRSCCNINAH
EPSS
0.11%
1.3th percentile
A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| libssh | libssh | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:H
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
libssh: libssh: denial of service via unchecked ProxyCommand fork() failure
vendor_redhat·2026-07-21·CVSS 5.3
CVE-2026-59845 [MEDIUM] libssh: libssh: denial of service via unchecked ProxyCommand fork() failure
libssh: libssh: denial of service via unchecked ProxyCommand fork() failure
A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service.
Statement: This Moderate flaw in libssh client-side ProxyCommand handling can lead to a local denial of service. When ProxyCommand is configured, an unchecked fork() failure may result in signals being sent across the process tree, disrupting local system availability. This issue specifically impacts environments utilizing ProxyCommand functionality.
Mitigation: To mitigate this issue, avoid using the ProxyCommand feature in libssh client configurations. This prevents the vulnera
GHSA
A flaw was found in libssh.
ghsa_unreviewed·2026-07-21
CVE-2026-59845 [MEDIUM] A flaw was found in libssh.
A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-59845 libssh: libssh: denial of service via unchecked ProxyCommand fork() failure [fedora-all]
bugzilla·2026-07-21·CVSS 5.3
CVE-2026-59845 [MEDIUM] CVE-2026-59845 libssh: libssh: denial of service via unchecked ProxyCommand fork() failure [fedora-all]
CVE-2026-59845 libssh: libssh: denial of service via unchecked ProxyCommand fork() failure [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in libssh client-side ProxyCommand handling. In ssh_socket_connect_proxycommand() in src/socket.c, the return value of fork() was not checked before being stored as the proxy child PID. If fork() fails, the value -1 can be retained in state and later used during cleanup, causing signals to be sent across the caller's accessible process tree. In deployments that use ProxyCommand, this can lead to local denial of service.
Bugzilla
CVE-2026-59845 libssh: libssh: denial of service via unchecked ProxyCommand fork() failure
bugzilla·2026-07-08·CVSS 5.3
CVE-2026-59845 [MEDIUM] CVE-2026-59845 libssh: libssh: denial of service via unchecked ProxyCommand fork() failure
CVE-2026-59845 libssh: libssh: denial of service via unchecked ProxyCommand fork() failure
A flaw was found in libssh client-side ProxyCommand handling. In ssh_socket_connect_proxycommand() in src/socket.c, the return value of fork() was not checked before being stored as the proxy child PID. If fork() fails, the value -1 can be retained in state and later used during cleanup, causing signals to be sent across the caller's accessible process tree. In deployments that use ProxyCommand, this can lead to local denial of service.
2026-07-21
Published