DeutschShown in its original language — a full translation is planned for a future version.
libssh: Mehrere Schwachstellen
view advisory published 2026-07-20
Ein Angreifer kann mehrere Schwachstellen in libssh ausnutzen, um erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Angriff auszulösen und Daten zu manipulieren.
01
describes (11)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-59851US | —OT elevated | — | ||
A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requ… | ||||
| CVE-2026-59850US | high7.5 | — | ||
A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading… | ||||
| CVE-2026-59849US | high7.5 | — | ||
A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when configured certificates are mis… | ||||
| CVE-2026-59848US | — | — | ||
A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and cli… | ||||
| CVE-2026-59847US | high7.5 | — | ||
A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to m… | ||||
| CVE-2026-59846US | — | — | ||
A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended… | ||||
| CVE-2026-59845US | medium5.9 | — | ||
A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's acce… | ||||
| CVE-2026-59844US | — | — | ||
A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memor… | ||||
| CVE-2026-59843US | — | — | ||
A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later channel writes to loop indefinitely and cons… | ||||
| CVE-2026-59842US | medium5.3 | — | ||
A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length is copied without proper length validat… | ||||
| CVE-2026-15370US | high7.3 | — | ||
A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes t… | ||||
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2026:42922 vom 2026-07-22external
- Red Hat Security Advisory RHSA-2026:47768 vom 2026-07-29external
- Red Hat Security Advisory RHSA-2026:55855 vom 2026-08-17external
- Red Hat Security Advisory RHSA-2026:62217 vom 2026-09-01external
- Red Hat Security Advisory RHSA-2026:62218 vom 2026-09-01external
- Rocky Linux Security Advisory RLSA-2026:55855 vom 2026-08-18external
- Rocky Linux Security Advisory RLSA-2026:62217 vom 2026-09-02external
- Rocky Linux Security Advisory RLSA-2026:62218 vom 2026-09-02external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan