Security Vulnerability in libssh: Denial of Service and Information Disclosure Risks
Summary
ALSA-2026:62217: Moderate: libssh security update. Affects libssh versions < 0.10.4-19.el9_8. Fixed in 0.10.4-19.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libssh is a widely-used library that implements the SSH protocol, enabling secure communication for client and server applications. It provides functionalities for secure file transfer, remote command execution, and secure shell access. However, vulnerabilities in libssh can lead to severe security risks, including denial of service and potential information disclosure.
Vulnerability Detail
The vulnerabilities in libssh stem from various issues, including a denial of service via zero advertised channel packet size (CVE-2026-59843), oversized SFTP read length (CVE-2026-59844), unchecked ProxyCommand fork() failure (CVE-2026-59845), and information disclosure via ProxyCommand %r username expansion (CVE-2026-59846). These vulnerabilities can lead to service interruptions and unauthorized access to sensitive information, compromising the integrity and availability of applications relying on libssh.
How To Fix
Minimum fixed version
0.10.4-19.el9_8
This is the first release that contains the fix.
sudo dnf update libsshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you may consider disabling features that utilize ProxyCommand or limit the use of SFTP until the package is updated. However, this is not a permanent solution and updating the package is highly recommended.
Conclusion
The vulnerabilities in libssh pose significant risks, including denial of service and potential information disclosure. It is crucial to update to the latest patched version to mitigate these risks. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for libssh →
FAQ
libssh is a library that implements the SSH protocol, allowing secure communication for client and server applications.
The main vulnerabilities include denial of service attacks and information disclosure risks due to improper handling of certain commands and packet sizes.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If immediate updates are not possible, consider implementing workarounds such as disabling ProxyCommand features or limiting SFTP usage until the update can be applied.
More detailed information about the vulnerabilities can be found on the CVE pages listed in the related section of the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for libssh.
