Moderate Security Update for libssh: Addressing Multiple Denial of Service Vulnerabilities
Summary
ALSA-2026:62218: Moderate: libssh security update. Affects libssh versions < 0.9.6-17.el8_10. Fixed in 0.9.6-17.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libssh is a widely used library that implements the SSH protocol, enabling secure communication between client and server applications. It is essential for secure file transfers and remote command execution. However, recent vulnerabilities have been identified that could compromise its integrity and availability, making it crucial for users to stay updated.
Vulnerability Detail
The vulnerabilities in libssh include multiple denial of service (DoS) issues, such as a zero advertised channel packet size, oversized SFTP read lengths, unchecked ProxyCommand fork() failures, and SFTP responses with unknown request IDs. Additionally, there are risks of information disclosure through ProxyCommand username expansion and integrity downgrades via OpenSSL AES-GCM tag verification. These vulnerabilities could allow attackers to disrupt service or gain unauthorized access to sensitive information.
How To Fix
Minimum fixed version
0.9.6-17.el8_10
This is the first release that contains the fix.
sudo dnf update libsshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the exposure of their SSH services by configuring firewalls to restrict access to trusted IP addresses only. Additionally, disabling unnecessary features in libssh can help mitigate some risks until the update is applied.
Conclusion
In summary, the recent vulnerabilities in libssh pose significant risks that can lead to denial of service and potential information disclosure. It is essential for users to update to the latest patched version to ensure the security and integrity of their applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for libssh →
FAQ
libssh is a library that implements the SSH protocol, allowing secure communication for client and server applications.
The vulnerabilities include denial of service attacks, information disclosure, and integrity downgrades.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
If an immediate update is not possible, consider implementing firewall rules to limit access and disabling unnecessary features in libssh.
For detailed information, refer to the CVE pages associated with the vulnerabilities, such as CVE-2026-59843 and others listed in the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for libssh.
