CVE-2026-0966

A flaw was found in libssh. The API function ssh_get_hexa() is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI (Generic Security Service Application Program Interface) authentication if the server's logging verbosity is set to SSH_LOG_PACKET (3) or higher. Successful exploitation could lead to a self-Denial of Service of the per-connection daemon process.

A flaw was found in libssh. The API function ssh_get_hexa() is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI (Generic Security Service Application Program Interface) authentication if the server's logging verbosity is set to SSH_LOG_PACKET (3) or higher. Successful exploitation could lead to a self-Denial of Service of the per-connection daemon process.

A flaw was found in libssh. The API function ssh_get_hexa() is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI (Generic Security Service Application Program Interface) authentication if the server's logging verbosity is set to SSH_LOG_PACKET (3) or higher. Successful exploitation could lead to a self-Denial of Service of the per-connection daemon process.

The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote programs. With its Secure FTP implementation, you can play with remote files easily, without third-party programs others than libcrypto (from openssl).

Security Fix(es):

(CVE-2026-0964)

(CVE-2026-0965)

(CVE-2026-0966)

(CVE-2026-0967)

(CVE-2026-0968)

The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote programs. With its Secure FTP implementation, you can play with remote files easily, without third-party programs others than libcrypto (from openssl).

Security Fix(es):

(CVE-2026-0964)

(CVE-2026-0965)

(CVE-2026-0966)

(CVE-2026-0967)

(CVE-2026-0968)

The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote programs. With its Secure FTP implementation, you can play with remote files easily, without third-party programs others than libcrypto (from openssl).

Security Fix(es):

(CVE-2026-0964)

(CVE-2026-0965)

(CVE-2026-0966)

(CVE-2026-0967)

(CVE-2026-0968)

A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component.(CVE-2026-3731)

The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote programs. With its Secure FTP implementation, you can play with remote files easily, without third-party programs others than libcrypto (from openssl).

Security Fix(es):

(CVE-2026-0964)

(CVE-2026-0965)

(CVE-2026-0966)

(CVE-2026-0967)

(CVE-2026-0968)

The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote programs. With its Secure FTP implementation, you can play with remote files easily, without third-party programs others than libcrypto (from openssl).

Security Fix(es):

(CVE-2026-0964)

(CVE-2026-0965)

(CVE-2026-0966)

(CVE-2026-0967)

(CVE-2026-0968)

The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote programs. With its Secure FTP implementation, you can play with remote files easily, without third-party programs others than libcrypto (from openssl).

Security Fix(es):

(CVE-2026-0965)

(CVE-2026-0966)

(CVE-2026-0968)

libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.

Security Fix(es):

• libssh: Buffer underflow in ssh_get_hexa() on invalid input (CVE-2026-0966)

• libssh: Improper sanitation of paths received from SCP servers (CVE-2026-0964)

• libssh: libssh: Denial of Service via improper configuration file handling (CVE-2026-0965)

• libssh: libssh: Denial of Service via inefficient regular expression processing (CVE-2026-0967)

• libssh: libssh: Denial of Service due to malformed SFTP message (CVE-2026-0968)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.

libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.

Security Fix(es):

• libssh: Double Free Vulnerability in libssh Key Export Functions (CVE-2025-5351)

• libssh: Use of uninitialized variable in privatekey_from_file() (CVE-2025-4878)

• libssh: Write beyond bounds in binary to base64 conversion functions (CVE-2025-4877)

• libssh: NULL Pointer Dereference in libssh KEX Session ID Calculation (CVE-2025-8114)

• libssh: Memory Exhaustion via Repeated Key Exchange in libssh (CVE-2025-8277)

• libssh: Buffer underflow in ssh_get_hexa() on invalid input (CVE-2026-0966)

• libssh: Improper sanitation of paths received from SCP servers (CVE-2026-0964)

• libssh: libssh: Denial of Service via improper configuration file handling (CVE-2026-0965)

• libssh: libssh: Denial of Service via inefficient regular expression processing (CVE-2026-0967)

• libssh: libssh: Denial of Service due to malformed SFTP message (CVE-2026-0968)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.

A flaw was found in libssh. The API function ssh_get_hexa() is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI (Generic Security Service Application Program Interface) authentication if the server's logging verbosity is set to SSH_LOG_PACKET (3) or higher. Successful exploitation could lead to a self-Denial of Service of the per-connection daemon process.

libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.

Security Fix(es):

• libssh: Buffer underflow in ssh_get_hexa() on invalid input (CVE-2026-0966)
• libssh: Improper sanitation of paths received from SCP servers (CVE-2026-0964)
• libssh: libssh: Denial of Service via improper configuration file handling (CVE-2026-0965)
• libssh: libssh: Denial of Service via inefficient regular expression processing (CVE-2026-0967)
• libssh: libssh: Denial of Service due to malformed SFTP message (CVE-2026-0968)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.

Security Fix(es):

• libssh: Double Free Vulnerability in libssh Key Export Functions (CVE-2025-5351)
• libssh: Use of uninitialized variable in privatekey_from_file() (CVE-2025-4878)
• libssh: Write beyond bounds in binary to base64 conversion functions (CVE-2025-4877)
• libssh: NULL Pointer Dereference in libssh KEX Session ID Calculation (CVE-2025-8114)
• libssh: Memory Exhaustion via Repeated Key Exchange in libssh (CVE-2025-8277)
• libssh: Buffer underflow in ssh_get_hexa() on invalid input (CVE-2026-0966)
• libssh: Improper sanitation of paths received from SCP servers (CVE-2026-0964)
• libssh: libssh: Denial of Service via improper configuration file handling (CVE-2026-0965)
• libssh: libssh: Denial of Service via inefficient regular expression processing (CVE-2026-0967)
• libssh: libssh: Denial of Service due to malformed SFTP message (CVE-2026-0968)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section.

A flaw was found in libssh. The API function ssh_get_hexa() is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI (Generic Security Service Application Program Interface) authentication if the server's logging verbosity is set to SSH_LOG_PACKET (3) or higher. Successful exploitation could lead to a self-Denial of Service of the per-connection daemon process.

• CVE-2026-0966: fix heap buffer underflow in ssh_get_hexa() on NULL or zero-length input, remotely reachable via GSSAPI authentication logging

• CVE-2026-0966: fix heap buffer underflow in ssh_get_hexa() on NULL or zero-length input, remotely reachable via GSSAPI authentication logging

• CVE-2026-0966: fix heap buffer underflow in ssh_get_hexa() on NULL or zero-length input, remotely reachable via GSSAPI authentication logging

• SECURITY UPDATE: heap buffer underflow in ssh_get_hexa() when called with a NULL pointer or zero-length input
  • debian/patches/CVE-2026-0966.patch: add NULL/zero-length input validation in ssh_get_hexa(); add unit-test coverage
  • CVE-2026-0966

• SECURITY UPDATE: heap buffer underflow in ssh_get_hexa() on zero-length or NULL input, remotely reachable via GSSAPI authentication logging
  • debian/patches/CVE-2026-0966.patch: reject NULL/zero-length input in ssh_get_hexa() in src/dh.c
  • CVE-2026-0966: fix heap buffer underflow in ssh_get_hexa()

• SECURITY UPDATE: heap buffer underflow in ssh_get_hexa() on zero-length or NULL input, remotely reachable via GSSAPI authentication logging
  • debian/patches/CVE-2026-0966.patch: reject NULL/zero-length input in ssh_get_hexa() in src/dh.c
  • CVE-2026-0966: fix heap buffer underflow in ssh_get_hexa()

• CVE-2026-0966: avoid 1-byte heap buffer underflow in ssh_get_hexa() on NULL/zero-length input

• CVE-2026-0966: fix heap buffer underflow in ssh_get_hexa() on NULL or zero-length input, remotely reachable via GSSAPI authentication logging

CVE-2026-0964 Improper sanitation of paths received from SCP servers CVE-2026-0965 The libssh can attempt to read non-regular files when misconfigured, which could cause resource exhaustion or blocking. CVE-2026-0966 Providing 0-length input for the ssh_get_hexa() causes 1-byte buffer underflow on heap, possibly causing memory corruption. CVE-2026-0967 Pattern matching at various places in libssh could lead to complex backtracking causing timeouts. CVE-2026-0968 Possible read behind bounds of longname

These are all security issues fixed in the libssh-config-0.11.4-1.1 package on the GA media of openSUSE Tumbleweed.

This update for libssh fixes the following issues:

• Update to version 0.11.4:
• CVE-2026-0964: SCP Protocol Path Traversal in ssh_scp_pull_request() (bsc#1258049)
• CVE-2026-0965: Possible Denial of Service when parsing unexpected configuration files (bsc#1258045)
• CVE-2026-0966: Buffer underflow in ssh_get_hexa() on invalid input (bsc#1258054)
• CVE-2026-0967: Specially crafted patterns could cause DoS (bsc#1258081)
• CVE-2026-0968: OOB Read in sftp_parse_longname() (bsc#1258080)
• CVE-2025-8114: Fix NULL pointer dereference after allocation failure (bsc#1246974)
• CVE-2025-8277: Fix memory leak of ephemeral key pair during repeated wrong KEX (bsc#1249375)

This update for libssh fixes the following issues:

• CVE-2026-0964: improper sanitation of paths received from SCP servers can cause path traversal (bsc#1258049).
• CVE-2026-0965: possible denial of service when parsing unexpected configuration files (bsc#1258045).
• CVE-2026-0966: buffer underflow in ssh_get_hexa() on invalid input (bsc#1258054).
• CVE-2026-0967: specially crafted patterns could cause denial of service (bsc#1258081).
• CVE-2026-0968: malformed SFTP message can lead to out of bound read (bsc#1258080).

This update for libssh fixes the following issues:

• CVE-2026-0964: improper sanitation of paths received from SCP servers can cause path traversal (bsc#1258049).
• CVE-2026-0965: possible denial of service when parsing unexpected configuration files (bsc#1258045).
• CVE-2026-0966: buffer underflow in ssh_get_hexa() on invalid input (bsc#1258054).
• CVE-2026-0967: specially crafted patterns could cause denial of service (bsc#1258081).
• CVE-2026-0968: malformed SFTP message can lead to out of bound read (bsc#1258080).

This update for libssh fixes the following issues:

• CVE-2026-0964: improper sanitation of paths received from SCP servers can cause path traversal (bsc#1258049).
• CVE-2026-0965: possible denial of service when parsing unexpected configuration files (bsc#1258045).
• CVE-2026-0966: buffer underflow in ssh_get_hexa() on invalid input (bsc#1258054).
• CVE-2026-0967: specially crafted patterns could cause denial of service (bsc#1258081).
• CVE-2026-0968: malformed SFTP message can lead to out of bound read (bsc#1258080).

This update for libssh fixes the following issues:

• CVE-2026-3731: denial of service via out-of-bounds read in SFTP extension name handler (bsc#1259377).
• CVE-2026-0964: SCP protocol path traversal in ssh_scp_pull_request() (bsc#1258049).
• CVE-2026-0965: possible denial of service when parsing unexpected configuration files (bsc#1258045).
• CVE-2026-0966: buffer underflow in ssh_get_hexa() on invalid input (bsc#1258054).
• CVE-2026-0967: specially crafted patterns could cause a denial of service (bsc#1258081).
• CVE-2026-0968: out-of-bounds read in sftp_parse_longname() (bsc#1258080).

This update for libssh fixes the following issues:

• CVE-2026-0964: improper sanitation of paths received from SCP servers can cause path traversal (bsc#1258049).
• CVE-2026-0965: possible denial of service when parsing unexpected configuration files (bsc#1258045).
• CVE-2026-0966: buffer underflow in ssh_get_hexa() on invalid input (bsc#1258054).
• CVE-2026-0967: specially crafted patterns could cause denial of service (bsc#1258081).
• CVE-2026-0968: malformed SFTP message can lead to out of bound read (bsc#1258080).
• CVE-2026-3731: denial of service via out-of-bounds read in SFTP extension name handler (bsc#1259377).

This update for libssh fixes the following issues:

• CVE-2026-0964: SCP Protocol Path Traversal in ssh_scp_pull_request() (bsc#1258049)
• CVE-2026-0965: Possible Denial of Service when parsing unexpected configuration files (bsc#1258045)
• CVE-2026-0966: Buffer underflow in ssh_get_hexa() on invalid input (bsc#1258054)
• CVE-2026-0967: Specially crafted patterns could cause DoS (bsc#1258081)
• CVE-2026-0968: OOB Read in sftp_parse_longname() (bsc#1258080)

This update for libssh fixes the following issues:

• CVE-2026-0964: improper sanitation of paths received from SCP servers can cause path traversal (bsc#1258049).
• CVE-2026-0965: possible denial of service when parsing unexpected configuration files (bsc#1258045).
• CVE-2026-0966: buffer underflow in ssh_get_hexa() on invalid input (bsc#1258054).
• CVE-2026-0967: specially crafted patterns could cause denial of service (bsc#1258081).
• CVE-2026-0968: malformed SFTP message can lead to out of bound read (bsc#1258080).

This update for libssh fixes the following issues:

• Update to version 0.11.4:
• CVE-2026-0964: SCP Protocol Path Traversal in ssh_scp_pull_request() (bsc#1258049)
• CVE-2026-0965: Possible Denial of Service when parsing unexpected configuration files (bsc#1258045)
• CVE-2026-0966: Buffer underflow in ssh_get_hexa() on invalid input (bsc#1258054)
• CVE-2026-0967: Specially crafted patterns could cause DoS (bsc#1258081)
• CVE-2026-0968: OOB Read in sftp_parse_longname() (bsc#1258080)
• CVE-2025-8114: Fix NULL pointer dereference after allocation failure (bsc#1246974)
• CVE-2025-8277: Fix memory leak of ephemeral key pair during repeated wrong KEX (bsc#1249375)

This update for libssh fixes the following issues:

• Update to version 0.11.4:
• CVE-2026-0964: SCP Protocol Path Traversal in ssh_scp_pull_request() (bsc#1258049)
• CVE-2026-0965: Possible Denial of Service when parsing unexpected configuration files (bsc#1258045)
• CVE-2026-0966: Buffer underflow in ssh_get_hexa() on invalid input (bsc#1258054)
• CVE-2026-0967: Specially crafted patterns could cause DoS (bsc#1258081)
• CVE-2026-0968: OOB Read in sftp_parse_longname() (bsc#1258080)
• CVE-2025-8114: Fix NULL pointer dereference after allocation failure (bsc#1246974)
• CVE-2025-8277: Fix memory leak of ephemeral key pair during repeated wrong KEX (bsc#1249375)

It was discovered that libssh clients incorrectly handled the key exchange process. A remote attacker could possibly use this issue to cause libssh clients to crash, resulting in a denial of service. (CVE-2025-8277)

It was discovered that the libssh SCP client incorrectly sanitized paths received from servers. A remote attacker could use this issue to cause libssh SCP clients to overwrite files outside of the working directory and possibly execute arbitrary code. (CVE-2026-0964)

It was discovered that libssh incorrectly handled parsing configuration files. A local attacker could possibly use this issue to cause libssh to access non-regular files, resulting in a denial of service. (CVE-2026-0965)

It was discovered that libssh incorrectly handled the ssh_get_hexa() function. A remote attacker could possibly use this issue to cause libssh to crash, resulting in a denial of service. (CVE-2026-0966)

It was discovered that libssh incorrectly handled certain regular expressions. A local attacker could possibly use this issue to cause libssh to consume resources, resulting in a denial of service. (CVE-2026-0967)

It was discovered that the libssh SFTP client incorrectly handled certain malformed longname fields. A remote attacker could use this issue to cause libssh SFTP clients to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-0968)