SB20260727145 - Multiple vulnerabilities in libssh

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260727145

SB20260727145 - Multiple vulnerabilities in libssh

Published: July 27, 2026

Security Bulletin ID SB20260727145
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 11
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 27% Low 73%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 11 vulnerabilities.


1) Improper access control (CVE-ID: CVE-2026-59851)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to impersonate any local user on the server.

The vulnerability exists due to improper access control in the libssh server gssapi-keyex authentication handling when processing gssapi-keyex authentication requests. A remote user can authenticate with valid Kerberos credentials and request an arbitrary username to impersonate any local user on the server.

Only SSH servers built on libssh with GSSAPIKeyExchange enabled are vulnerable.


2) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-59845)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of fork() failure in ProxyCommand execution in the libssh client when cleaning up a session after executing a ProxyCommand. A local user can trigger a fork() failure and then cause the process to send a KILL signal to process group -1 to cause a denial of service.

This issue affects the client only and typically occurs under low-memory conditions.


3) Stack-based buffer overflow (CVE-ID: CVE-2026-15370)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to stack-based buffer overflow in the sftp server longname field construction when listing an attacker-controlled directory with long filenames. A local user can cause a user to list a crafted directory to execute arbitrary code.

User interaction is required to list files in an attacker-controlled directory on a filesystem that allows long filenames.


4) Infinite loop (CVE-ID: CVE-2026-59843)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to an infinite loop in channel_write_common() when processing an SSH_MSG_CHANNEL_OPEN request with a maximum packet length of zero. A remote user can send a specially crafted channel open request to cause a denial of service.

Repeating the attack over multiple connections can exhaust CPU resources of the server.


5) Input validation error (CVE-ID: CVE-2026-59844)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper input validation in the libssh SFTP server when processing SSH_FXP_READ requests. A remote user can send a specially crafted SSH_FXP_READ request with an excessive read length value to cause a denial of service.

The issue can be sustained by repeatedly issuing large read requests simultaneously over multiple SFTP channels.


6) Out-of-bounds read (CVE-ID: CVE-2026-59842)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in ssh_server_gss_kex_process_init when processing a GSSAPI key exchange with a malformed ephemeral Curve25519 public key. A remote attacker can send a specially crafted public key to disclose sensitive information.

Successful exploitation relies on observing whether key exchange succeeds after sending a shortened public key prefix, which may expose up to 32 bytes of adjacent heap memory.


7) OS Command Injection (CVE-ID: CVE-2026-59846)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper neutralization of special elements in the ProxyCommand username expansion in the client component when expanding a user-supplied username into a ProxyCommand executed by the shell. A local user can supply a malicious username and trick the victim into initiating a connection to disclose sensitive information.

User interaction is required to initiate the connection, and the issue is limited to the client side.


8) Improper validation of integrity check value (CVE-ID: CVE-2026-59847)

CWE-ID: CWE-354 - Improper Validation of Integrity Check Value

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to modify plaintext transmitted over the connection without being detected.

The vulnerability exists due to improper integrity check in the OpenSSL AES-GCM backend when processing encrypted SSH traffic. A remote attacker can flip bits in packets in transit to modify plaintext transmitted over the connection without being detected.

Only OpenSSL-based server and client configurations using the affected AES-GCM ciphers are vulnerable. Successful exploitation requires knowledge of the expected plaintext format of the packets.


9) Resource exhaustion (CVE-ID: CVE-2026-59848)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of unexpected responses in the sftp client response queue when processing server-supplied sftp response packets. A remote attacker can send response packets with unknown request IDs to cause a denial of service.

The issue affects the client side only.


10) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-59849)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper state management in ssh_userauth_publickey_auto() when handling automatic public key authentication with configured certificates. A remote user can reject a configured certificate or trigger error handling for a missing configured certificate to cause a denial of service.

Only the client side is affected, and exploitation requires a specific configuration in which certificate-based automatic authentication is used; the infinite loop occurs when the server does not enforce an authentication limit.


11) Use-after-free (CVE-ID: CVE-2026-59850)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to use-after-free in channel data callbacks when processing data on closed channels. A remote user can send data through a closed channel to cause a denial of service.

The issue affects both server and client components and is exemplified on SFTP channels.


Remediation

Install update from vendor's website.

References