CVE-2026-59849
published 2026-07-21CVE-2026-59849: A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when configured…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.44%
37.0th percentile
A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when configured certificates are missing or repeatedly rejected by a server, leading to denial of service.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| libssh | libssh | — | — |
| libssh | libssh | — | — |
| libssh | libssh | >= 0.11.0 < 0.11.5 | 0.11.5 |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux_for_els | — | — |
| redhat | enterprise_linux_for_eus | — | — |
| redhat | enterprise_linux_for_ibm_z_systems | — | — |
| redhat | enterprise_linux_for_ibm_z_systems | — | — |
| redhat | enterprise_linux_for_ibm_z_systems_els | — | — |
| redhat | enterprise_linux_for_ibm_z_systems_eus | — | — |
| redhat | enterprise_linux_for_power_little_endian | — | — |
| redhat | enterprise_linux_for_power_little_endian | — | — |
| redhat | enterprise_linux_for_power_little_endian_els | — | — |
| redhat | enterprise_linux_for_power_little_endian_eus | — | — |
| ubuntu | libssh | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_ubuntu7.3HIGH
vendor_redhat3.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
libssh vulnerabilities
vendor_ubuntu·2026-08-31·CVSS 7.3
CVE-2026-59846 [HIGH] libssh vulnerabilities
Title: libssh vulnerabilities
Summary: Several security issues were fixed in libssh.
It was discovered that libssh had a stack buffer overflow in its SFTP
server when constructing directory listing entries for long filenames. An
attacker could possibly use this issue to cause libssh to crash or execute
arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-15370)
It was discovered that libssh did not correctly handle SSH channel open
messages advertising a zero maximum packet size. An authenticated remote
attacker could possibly use this issue to cause libssh to consume excessive
CPU resources, leading to a denial of service. (CVE-2026-59843)
It was discovered that libssh did not correctly limit SFTP read request
lengths in its server implementation. An authenticated remo
Red Hat
libssh: libssh: denial of service via automatic certificate authentication loop
vendor_redhat·2026-07-21·CVSS 3.1
CVE-2026-59849 [LOW] CWE-835 libssh: libssh: denial of service via automatic certificate authentication loop
libssh: libssh: denial of service via automatic certificate authentication loop
A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when configured certificates are missing or repeatedly rejected by a server, leading to denial of service.
Mitigation: Do not connect to untrusted SSH servers and do not use certificates until patched.
Package: libssh (Red Hat Enterprise Linux 10) - Fix deferred
Package: libssh (Red Hat Enterprise Linux 8) - Not affected
Package: libssh (Red Hat Enterprise Linux 9) - Not affected
Package: libssh (Red Hat Hardened Images) - Affected
GHSA
A flaw was found in libssh.
ghsa_unreviewed·2026-07-21
CVE-2026-59849 [LOW] CWE-835 A flaw was found in libssh.
A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when configured certificates are missing or repeatedly rejected by a server, leading to denial of service.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-59849 libssh: libssh: denial of service via automatic certificate authentication loop [fedora-all]
bugzilla·2026-07-21·CVSS 3.1
CVE-2026-59849 [LOW] CVE-2026-59849 libssh: libssh: denial of service via automatic certificate authentication loop [fedora-all]
CVE-2026-59849 libssh: libssh: denial of service via automatic certificate authentication loop [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in libssh automatic certificate-based public key authentication. In ssh_userauth_publickey_auto() in src/auth.c, the iterator over certificate candidates was not advanced correctly when configured certificates were missing or repeatedly rejected by the server. Under specific non-default certificate configurations, this could cause the client to restart the same authentication attempts indefinitely, leading to denial of service.
Bugzilla
CVE-2026-59849 libssh: libssh: denial of service via automatic certificate authentication loop
bugzilla·2026-07-08·CVSS 3.1
CVE-2026-59849 [LOW] CVE-2026-59849 libssh: libssh: denial of service via automatic certificate authentication loop
CVE-2026-59849 libssh: libssh: denial of service via automatic certificate authentication loop
A flaw was found in libssh automatic certificate-based public key authentication. In ssh_userauth_publickey_auto() in src/auth.c, the iterator over certificate candidates was not advanced correctly when configured certificates were missing or repeatedly rejected by the server. Under specific non-default certificate configurations, this could cause the client to restart the same authentication attempts indefinitely, leading to denial of service.
2026-07-21
Published