{"id":"CVE-2026-59846","aliases":["ALPINE-CVE-2026-59846","ALSA-2026:55855","ALSA-2026:62217","ALSA-2026:62218","BELL-CVE-2026-59846","CLSA-2026-1787056678","DEBIAN-CVE-2026-59846","EUVD-2026-46254","GHSA-fvwj-j79q-57v7","MGASA-2026-0425","RHSA-2026:42922","RHSA-2026:55855","RHSA-2026:62217","RHSA-2026:62218","RLSA-2026:55855","RLSA-2026:62217","RLSA-2026:62218","SUSE-SU-2026:22940-1","SUSE-SU-2026:22948-1","SUSE-SU-2026:22956-1","SUSE-SU-2026:23056-1","SUSE-SU-2026:23168-1","SUSE-SU-2026:3302-1","SUSE-SU-2026:3330-1","SUSE-SU-2026:3463-1","UBUNTU-CVE-2026-59846","USN-8699-1","openSUSE-SU-2026:11377-1","openSUSE-SU-2026:21444-1"],"status":"published","title":"Libssh: libssh: information disclosure via proxycommand %r username expansion","description":"A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.","severity":{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0012,"percentile":0.01829,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-77","CWE-78"],"published":"2026-07-21T12:55:56Z","modified":"2026-11-03T06:32:58Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"libssh","fixed_in":["0.12.1-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"libssh","fixed_in":["0.11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"libssh","fixed_in":["0.11.5-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"libssh","fixed_in":["0.12.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libssh","fixed_in":["0.10.6-0+deb12u3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libssh","fixed_in":["0.11.5-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libssh","fixed_in":["0.12.1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libssh","fixed_in":["0.9.6-2ubuntu0.22.04.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libssh","fixed_in":["0.10.6-2ubuntu0.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libssh","fixed_in":["0.11.3-1ubuntu2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.1-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.0-3.el10_2"}]}],"bundled":11},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libssh-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.0-3.el10_2"}]}],"bundled":11},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libssh-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.0-3.el10_2"}]}],"bundled":11},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.4-19.el9_8"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libssh-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.4-19.el9_8"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libssh-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.4-19.el9_8"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-17.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libssh-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-17.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libssh-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-17.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"Alpaquita:23","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.10.4-r0"},{"fixed":"0.11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.11.1-r0"},{"fixed":"0.11.5-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.6-r1"},{"fixed":"0.12.1-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.4-8.el9_2.tuxcare.els15"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libssh-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.4-8.el9_2.tuxcare.els15"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libssh-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.4-8.el9_2.tuxcare.els15"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.6-0+deb12u3"}]}],"versions":["0.10.5-2","0.10.5-3","0.10.5-3+hurd.1","0.10.6-0+deb12u1","0.10.6-0+deb12u2"]},{"source":"osv","ecosystem":"Debian:13","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.5-0+deb13u1"}]}],"versions":["0.11.2-1","0.11.2-1+deb13u1","0.11.3-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.1-1"}]}],"versions":["0.11.2-1","0.11.3-1","0.12.0-1","0.12.0-2","0.12.0-3"]},{"source":"osv","ecosystem":"Mageia:10","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.5-1.mga10"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:9","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.6-1.3.mga9"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.1-4.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libssh-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.1-4.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libssh-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.1-4.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.0-3.el10_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libssh-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.0-3.el10_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libssh-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.0-3.el10_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.0-3.el10_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libssh-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.0-3.el10_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-19.el9_8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libssh-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-19.el9_8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libssh-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-19.el9_8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-19.el9_8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libssh-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-19.el9_8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-19.el9_8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libssh-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-19.el9_8"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.6-17.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libssh-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.6-17.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libssh-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.6-17.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.6-17.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libssh-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.6-17.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.6-17.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libssh-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.6-17.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:10","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.0-3.el10_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Rocky Linux:9","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.4-19.el9_8"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.6-17.el8_10"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.5-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.5-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.5-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.5-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.5-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.6-5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.6-slfo.1.1_6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-3.24.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-3.24.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150600.11.15.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150600.11.15.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150600.11.15.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.20.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.20.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.20.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.20.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.20.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.20.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.20.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.20.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.20.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.20.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.20.1"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.3-3ubuntu3","0.6.3-4.1","0.6.3-4.2","0.6.3-4.2ubuntu1","0.6.3-4.3","0.6.3-4.3ubuntu0.1","0.6.3-4.3ubuntu0.2","0.6.3-4.3ubuntu0.5","0.6.3-4.3ubuntu0.6","0.6.3-4.3ubuntu0.6+esm1","0.6.3-4.3ubuntu0.6+esm2","0.6.3-4.3ubuntu0.6+esm3","0.6.3-4.3ubuntu0.6+esm4","0.6.3-4.3ubuntu0.6+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.7.5-1","0.8.0~20170825.94fa1e38-1","0.8.0~20170825.94fa1e38-1build1","0.8.0~20170825.94fa1e38-1ubuntu0.1","0.8.0~20170825.94fa1e38-1ubuntu0.2","0.8.0~20170825.94fa1e38-1ubuntu0.5","0.8.0~20170825.94fa1e38-1ubuntu0.6","0.8.0~20170825.94fa1e38-1ubuntu0.7","0.8.0~20170825.94fa1e38-1ubuntu0.7+esm3","0.8.0~20170825.94fa1e38-1ubuntu0.7+esm4","0.8.0~20170825.94fa1e38-1ubuntu0.7+esm5","0.8.0~20170825.94fa1e38-1ubuntu0.7+esm6","0.8.0~20170825.94fa1e38-1ubuntu0.7+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.0-1ubuntu1","0.9.0-1ubuntu4","0.9.0-1ubuntu5","0.9.3-2ubuntu1","0.9.3-2ubuntu2","0.9.3-2ubuntu2.1","0.9.3-2ubuntu2.2","0.9.3-2ubuntu2.3","0.9.3-2ubuntu2.4","0.9.3-2ubuntu2.5","0.9.3-2ubuntu2.5+esm1","0.9.3-2ubuntu2.5+esm2","0.9.3-2ubuntu2.5+esm3","0.9.3-2ubuntu2.5+esm4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-2ubuntu0.22.04.8"}]}],"versions":["0.9.6-1","0.9.6-1build1","0.9.6-2","0.9.6-2build1","0.9.6-2ubuntu0.22.04.1","0.9.6-2ubuntu0.22.04.2","0.9.6-2ubuntu0.22.04.3","0.9.6-2ubuntu0.22.04.4","0.9.6-2ubuntu0.22.04.5","0.9.6-2ubuntu0.22.04.6","0.9.6-2ubuntu0.22.04.7"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.6-2ubuntu0.5"}]}],"versions":["0.10.5-3ubuntu1","0.10.5-3ubuntu2","0.10.6-2","0.10.6-2build1","0.10.6-2build2","0.10.6-2ubuntu0.1","0.10.6-2ubuntu0.2","0.10.6-2ubuntu0.3","0.10.6-2ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.3-1ubuntu2.1"}]}],"versions":["0.11.2-1build1","0.11.3-1","0.11.3-1ubuntu1","0.11.3-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-2ubuntu0.22.04.8"}]}],"versions":["0.9.6-1","0.9.6-1build1","0.9.6-2","0.9.6-2build1","0.9.6-2ubuntu0.22.04.1","0.9.6-2ubuntu0.22.04.2","0.9.6-2ubuntu0.22.04.3","0.9.6-2ubuntu0.22.04.4","0.9.6-2ubuntu0.22.04.5","0.9.6-2ubuntu0.22.04.6","0.9.6-2ubuntu0.22.04.7"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.6-2ubuntu0.5"}]}],"versions":["0.10.5-3ubuntu1","0.10.5-3ubuntu2","0.10.6-2","0.10.6-2build1","0.10.6-2build2","0.10.6-2ubuntu0.1","0.10.6-2ubuntu0.2","0.10.6-2ubuntu0.3","0.10.6-2ubuntu0.4"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.3-1ubuntu2.1"}]}],"versions":["0.11.2-1build1","0.11.3-1","0.11.3-1ubuntu1","0.11.3-1ubuntu2"],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.5-1.2"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.5-160000.1.1"}]}],"bundled":9}],"products":[{"vendor":"libssh","product":"libssh"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"redhat","product":"hardened_images"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:42922","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:55855","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:62217","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:62218","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59846","tags":["vdb-entry","x_refsource_REDHAT","Vendor Advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498179","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59846","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-fvwj-j79q-57v7"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-59846","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-15370","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59842","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59843","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59844","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59845","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59847","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59848","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59849","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59850","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59851","tags":["report"]},{"url":"https://bugzilla.redhat.com/2498168","tags":["report"]},{"url":"https://bugzilla.redhat.com/2498176","tags":["report"]},{"url":"https://bugzilla.redhat.com/2498177","tags":["report"]},{"url":"https://bugzilla.redhat.com/2498178","tags":["report"]},{"url":"https://bugzilla.redhat.com/2498179","tags":["report"]},{"url":"https://bugzilla.redhat.com/2498180","tags":["report"]},{"url":"https://bugzilla.redhat.com/2498181","tags":["report"]},{"url":"https://bugzilla.redhat.com/2498182","tags":["report"]},{"url":"https://bugzilla.redhat.com/2498183","tags":["report"]},{"url":"https://bugzilla.redhat.com/2498184","tags":["report"]},{"url":"https://bugzilla.redhat.com/2499049","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-55855.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-62217.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-62218.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-59846","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1787056678.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4878","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-59846","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0425.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35983","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/21/7","tags":["web"]},{"url":"https://www.libssh.org/2026/07/21/libssh-0-12-1-and-0-11-5-security-releases/","tags":["web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MIVTLBAG4MPX3WGPMVYDO2UPZB6G3ESR/","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/YZ324UUCGQ4JEC4ZOJMJODWYVPSFBWUU/","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00321.html","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-8699-1","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_42922.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498168","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59842","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59842","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498176","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59843","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59843","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498177","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59844","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59844","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498178","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59845","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59845","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59846","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498180","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59847","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59847","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498181","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59848","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59848","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498182","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59849","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59849","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498183","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59850","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59850","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498184","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59851","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59851","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2499049","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55855.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15370","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15370","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_62217.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_62218.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:55855","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:62217","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:62218","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622940-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1272162","tags":["report"]},{"url":"https://bugzilla.suse.com/1272164","tags":["report"]},{"url":"https://bugzilla.suse.com/1272165","tags":["report"]},{"url":"https://bugzilla.suse.com/1272166","tags":["report"]},{"url":"https://bugzilla.suse.com/1272167","tags":["report"]},{"url":"https://bugzilla.suse.com/1272168","tags":["report"]},{"url":"https://bugzilla.suse.com/1272169","tags":["report"]},{"url":"https://bugzilla.suse.com/1272170","tags":["report"]},{"url":"https://bugzilla.suse.com/1272171","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15370","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59843","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59844","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59849","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59850","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622948-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622956-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623056-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1259377","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3731","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623168-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263302-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263330-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263463-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-59846","tags":["report"]},{"url":"https://www.libssh.org/security/advisories/CVE-2026-59846.txt","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-15370","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-59843","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-59844","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-59845","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-59847","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-59848","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-59849","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-59850","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-59846","title":"Libssh: libssh: information disclosure via proxycommand %r username expansion","description":"A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.","status":"published","published":"2026-07-21T12:55:56.532Z","modified":"2026-11-06T19:28:52.787Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-78","CWE-77"],"updated_at":"2026-11-06T20:30:05.028126Z"}],"euvd":[{"id":"EUVD-2026-46254","description":"A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.","status":"published","published":"2026-07-21T12:55:56Z","modified":"2026-11-06T19:28:52Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-06T20:06:05.048214Z"}],"ghsa":[{"id":"GHSA-fvwj-j79q-57v7","title":"A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can...","description":"A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.","status":"published","published":"2026-07-21T15:30:43Z","modified":"2026-09-01T21:31:14Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-77","CWE-78"],"updated_at":"2026-11-02T15:11:14.651489Z"}],"nvd":[{"id":"CVE-2026-59846","description":"A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.","status":"published","published":"2026-07-21T13:17:18.143Z","modified":"2026-09-01T21:18:34.74Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-78","CWE-77"],"updated_at":"2026-11-02T14:12:31.024898Z"}],"osv":[{"id":"ALPINE-CVE-2026-59846","description":"A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.","status":"published","published":"2026-07-21T13:17:18.143Z","modified":"2026-11-03T06:32:58.116394546Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-03T07:16:09.603409Z"},{"id":"BELL-CVE-2026-59846","status":"published","published":"2026-07-22T06:04:20.898181Z","modified":"2026-07-30T07:15:09.007567419Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:28:24.657778Z"},{"id":"DEBIAN-CVE-2026-59846","description":"A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.","status":"published","published":"2026-07-21T13:17:18.143Z","modified":"2026-10-20T21:00:07.282237675Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:45:57.932517Z"},{"id":"RHSA-2026:42922","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-07-23T10:14:19Z","modified":"2026-10-06T10:31:35.349879842Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:55855","title":"Red Hat Security Advisory: libssh security update","status":"published","published":"2026-08-18T10:21:15Z","modified":"2026-09-02T10:20:23Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:62217","title":"Red Hat Security Advisory: libssh security update","status":"published","published":"2026-09-02T10:22:23Z","modified":"2026-09-02T10:33:15.000365563Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:62218","title":"Red Hat Security Advisory: libssh security update","status":"published","published":"2026-09-02T10:22:23Z","modified":"2026-09-02T10:33:15.697849568Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RLSA-2026:55855","title":"Important: libssh security update","description":"libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.\n\nSecurity Fix(es):\n\n* libssh: libssh: information disclosure via short GSSAPI Curve25519 public key (CVE-2026-59842)\n\n* libssh: libssh: denial of service via zero advertised channel packet size (CVE-2026-59843)\n\n* libssh: libssh: denial of service via oversized SFTP read length (CVE-2026-59844)\n\n* libssh: libssh: denial of service via unchecked ProxyCommand fork() failure (CVE-2026-59845)\n\n* libssh: libssh: information disclosure via ProxyCommand %r username expansion (CVE-2026-59846)\n\n* libssh: libssh: integrity downgrade via OpenSSL AES-GCM tag verification (CVE-2026-59847)\n\n* libssh: libssh: denial of service via SFTP responses with unknown request IDs (CVE-2026-59848)\n\n* libssh: libssh: denial of service via automatic certificate authentication loop (CVE-2026-59849)\n\n* libssh: libssh: use-after-free via data callbacks on closed channels (CVE-2026-59850)\n\n* libssh: libssh: authentication bypass via missing GSSAPI principal check (CVE-2026-59851)\n\n* libssh: libssh: stack buffer overflow in SFTP server longname construction (CVE-2026-15370)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-18T12:07:31.722662Z","modified":"2026-08-18T12:30:03.262239025Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:62217","title":"Moderate: libssh security update","description":"libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.\n\nSecurity Fix(es):\n\n* libssh: libssh: denial of service via zero advertised channel packet size (CVE-2026-59843)\n\n* libssh: libssh: denial of service via oversized SFTP read length (CVE-2026-59844)\n\n* libssh: libssh: denial of service via unchecked ProxyCommand fork() failure (CVE-2026-59845)\n\n* libssh: libssh: information disclosure via ProxyCommand %r username expansion (CVE-2026-59846)\n\n* libssh: libssh: integrity downgrade via OpenSSL AES-GCM tag verification (CVE-2026-59847)\n\n* libssh: libssh: denial of service via SFTP responses with unknown request IDs (CVE-2026-59848)\n\n* libssh: libssh: use-after-free via data callbacks on closed channels (CVE-2026-59850)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-02T06:05:06.352101Z","modified":"2026-09-02T06:30:02.970928743Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:62218","title":"Moderate: libssh security update","description":"libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.\n\nSecurity Fix(es):\n\n* libssh: libssh: denial of service via zero advertised channel packet size (CVE-2026-59843)\n\n* libssh: libssh: denial of service via oversized SFTP read length (CVE-2026-59844)\n\n* libssh: libssh: denial of service via unchecked ProxyCommand fork() failure (CVE-2026-59845)\n\n* libssh: libssh: information disclosure via ProxyCommand %r username expansion (CVE-2026-59846)\n\n* libssh: libssh: integrity downgrade via OpenSSL AES-GCM tag verification (CVE-2026-59847)\n\n* libssh: libssh: denial of service via SFTP responses with unknown request IDs (CVE-2026-59848)\n\n* libssh: libssh: use-after-free via data callbacks on closed channels (CVE-2026-59850)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-02T06:01:10.749163Z","modified":"2026-09-02T06:30:02.250362949Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2026-59846","description":"A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.","status":"published","published":"2026-07-21T13:17:00Z","modified":"2026-08-31T17:16:50.291436481Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T16:56:41.911783Z"},{"id":"ALSA-2026:55855","title":"Important: libssh security update","description":"libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.  \n\nSecurity Fix(es):  \n\n  * libssh: libssh: information disclosure via short GSSAPI Curve25519 public key (CVE-2026-59842)\n  * libssh: libssh: denial of service via zero advertised channel packet size (CVE-2026-59843)\n  * libssh: libssh: denial of service via oversized SFTP read length (CVE-2026-59844)\n  * libssh: libssh: denial of service via unchecked ProxyCommand fork() failure (CVE-2026-59845)\n  * libssh: libssh: information disclosure via ProxyCommand %r username expansion (CVE-2026-59846)\n  * libssh: libssh: integrity downgrade via OpenSSL AES-GCM tag verification (CVE-2026-59847)\n  * libssh: libssh: denial of service via SFTP responses with unknown request IDs (CVE-2026-59848)\n  * libssh: libssh: denial of service via automatic certificate authentication loop (CVE-2026-59849)\n  * libssh: libssh: use-after-free via data callbacks on closed channels (CVE-2026-59850)\n  * libssh: libssh: authentication bypass via missing GSSAPI principal check (CVE-2026-59851)\n  * libssh: libssh: stack buffer overflow in SFTP server longname construction (CVE-2026-15370)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-17T00:00:00Z","modified":"2026-10-29T11:30:38.455872369Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:62217","title":"Moderate: libssh security update","description":"libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.  \n\nSecurity Fix(es):  \n\n  * libssh: libssh: denial of service via zero advertised channel packet size (CVE-2026-59843)\n  * libssh: libssh: denial of service via oversized SFTP read length (CVE-2026-59844)\n  * libssh: libssh: denial of service via unchecked ProxyCommand fork() failure (CVE-2026-59845)\n  * libssh: libssh: information disclosure via ProxyCommand %r username expansion (CVE-2026-59846)\n  * libssh: libssh: integrity downgrade via OpenSSL AES-GCM tag verification (CVE-2026-59847)\n  * libssh: libssh: denial of service via SFTP responses with unknown request IDs (CVE-2026-59848)\n  * libssh: libssh: use-after-free via data callbacks on closed channels (CVE-2026-59850)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-01T00:00:00Z","modified":"2026-10-29T11:32:36.987824775Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:62218","title":"Moderate: libssh security update","description":"libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.  \n\nSecurity Fix(es):  \n\n  * libssh: libssh: denial of service via zero advertised channel packet size (CVE-2026-59843)\n  * libssh: libssh: denial of service via oversized SFTP read length (CVE-2026-59844)\n  * libssh: libssh: denial of service via unchecked ProxyCommand fork() failure (CVE-2026-59845)\n  * libssh: libssh: information disclosure via ProxyCommand %r username expansion (CVE-2026-59846)\n  * libssh: libssh: integrity downgrade via OpenSSL AES-GCM tag verification (CVE-2026-59847)\n  * libssh: libssh: denial of service via SFTP responses with unknown request IDs (CVE-2026-59848)\n  * libssh: libssh: use-after-free via data callbacks on closed channels (CVE-2026-59850)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-01T00:00:00Z","modified":"2026-10-29T11:02:29.056593029Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"CLSA-2026-1787056678","title":"libssh: Fix of 2 CVEs","description":"- CVE-2025-4878: initialize pointers and properly check the return value\n  of ssh_pki_import_privkey_file() in privatekey_from_file(), so a missing\n  key file no longer leaves an uninitialized key in use\n- CVE-2026-59846: validate usernames and reject shell metacharacters before\n  they are expanded into a shell-evaluated ProxyCommand","status":"published","published":"2026-08-18T12:38:09Z","modified":"2026-10-26T09:30:31.730554291Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"MGASA-2026-0425","title":"Updated libssh packages fix security vulnerabilities","description":"Stack buffer overflow in SFTP server longname construction.\n(CVE-2026-15370)\nDenial of service via zero advertised channel packet size.\n(CVE-2026-59843)\nDenial of service via oversized SFTP read length. (CVE-2026-59844)\nDenial of service via unchecked ProxyCommand fork() failure.\n(CVE-2026-59845)\nInformation disclosure via ProxyCommand %r username expansion.\n(CVE-2026-59846)\nIntegrity downgrade via OpenSSL AES-GCM tag verification.\n(CVE-2026-59847)\nDenial of service via SFTP responses with unknown request IDs.\n(CVE-2026-59848)\nDenial of service via automatic certificate authentication loop.\n(CVE-2026-59849)\nUse-after-free via data callbacks on closed channels. (CVE-2026-59850)\n","status":"published","published":"2026-09-20T04:25:32Z","modified":"2026-09-20T04:30:03.288305532Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11377-1","title":"libssh-config-0.11.5-1.1 on GA media","description":"These are all security issues fixed in the libssh-config-0.11.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-26T00:00:00Z","modified":"2026-07-27T09:00:09.944598318Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21444-1","title":"Security update for libssh","description":"This update for libssh fixes the following issues:\n\n- CVE-2026-15370: stack buffer overflow in SFTP server longname construction (bsc#1272162).\n- CVE-2026-59843: denial of service via zero advertised channel packet size (bsc#1272164).\n- CVE-2026-59844: denial of service via oversized SFTP read length (bsc#1272165).\n- CVE-2026-59845: denial of service via unchecked ProxyCommand fork() failure (bsc#1272166).\n- CVE-2026-59846: information disclosure via ProxyCommand %r username expansion (bsc#1272167).\n- CVE-2026-59847: integrity downgrade via OpenSSL AES-GCM tag verification (bsc#1272168).\n- CVE-2026-59848: denial of service via SFTP responses with unknown request IDs (bsc#1272169).\n- CVE-2026-59849: denial of service via automatic certificate authentication loop (bsc#1272170).\n- CVE-2026-59850: use-after-free via data callbacks on closed channels (bsc#1272171).\n\nChanges for libssh:\n\n- Update to 0.11.5:\n\n * Zero-initialize every ssh_string\n * Fix compatibility with C23 / gcc16\n * Fix multiple memory leaks, null checks, and error checks\n * Validate peer public key in DH key exchange\n * Avoid remote window overflow\n * Avoid off-by-one overflow during kbdint authentication\n * Avoid logging uninitialized sequence numbers\n * Avoid double conversion of SFTP version number\n * Send correct SFTP server version number\n * Avoid handling repeated SFTP INIT messages\n * Harmonize return values from SFTP server callbacks\n\n- Update %suse_version checks for SLES 16.x (jsc#PED-15815)\n","status":"published","published":"2026-07-25T17:18:11Z","modified":"2026-07-26T18:15:06.107714505Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22940-1","title":"Security update for libssh","description":"This update for libssh fixes the following issues:\n\n- CVE-2026-15370: stack buffer overflow in SFTP server longname construction (bsc#1272162).\n- CVE-2026-59843: denial of service via zero advertised channel packet size (bsc#1272164).\n- CVE-2026-59844: denial of service via oversized SFTP read length (bsc#1272165).\n- CVE-2026-59845: denial of service via unchecked ProxyCommand fork() failure (bsc#1272166).\n- CVE-2026-59846: information disclosure via ProxyCommand %r username expansion (bsc#1272167).\n- CVE-2026-59847: integrity downgrade via OpenSSL AES-GCM tag verification (bsc#1272168).\n- CVE-2026-59848: denial of service via SFTP responses with unknown request IDs (bsc#1272169).\n- CVE-2026-59849: denial of service via automatic certificate authentication loop (bsc#1272170).\n- CVE-2026-59850: use-after-free via data callbacks on closed channels (bsc#1272171).\n\nChanges for libssh:\n\n- Update to 0.11.5:\n\n * Zero-initialize every ssh_string\n * Fix compatibility with C23 / gcc16\n * Fix multiple memory leaks, null checks, and error checks\n * Validate peer public key in DH key exchange\n * Avoid remote window overflow\n * Avoid off-by-one overflow during kbdint authentication\n * Avoid logging uninitialized sequence numbers\n * Avoid double conversion of SFTP version number\n * Send correct SFTP server version number\n * Avoid handling repeated SFTP INIT messages\n * Harmonize return values from SFTP server callbacks\n\n- Update %suse_version checks for SLES 16.x (jsc#PED-15815)\n","status":"published","published":"2026-07-25T17:15:12Z","modified":"2026-07-29T18:24:22.157642614Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:22948-1","title":"Security update for libssh","description":"This update for libssh fixes the following issues:\n\n- CVE-2026-15370: stack buffer overflow in SFTP server longname construction (bsc#1272162).\n- CVE-2026-59843: denial of service via zero advertised channel packet size (bsc#1272164).\n- CVE-2026-59844: denial of service via oversized SFTP read length (bsc#1272165).\n- CVE-2026-59845: denial of service via unchecked ProxyCommand fork() failure (bsc#1272166).\n- CVE-2026-59846: information disclosure via ProxyCommand %r username expansion (bsc#1272167).\n- CVE-2026-59847: integrity downgrade via OpenSSL AES-GCM tag verification (bsc#1272168).\n- CVE-2026-59848: denial of service via SFTP responses with unknown request IDs (bsc#1272169).\n- CVE-2026-59849: denial of service via automatic certificate authentication loop (bsc#1272170).\n- CVE-2026-59850: use-after-free via data callbacks on closed channels (bsc#1272171).\n\nChanges for libssh:\n\n- Update to 0.11.5:\n\n * Zero-initialize every ssh_string\n * Fix compatibility with C23 / gcc16\n * Fix multiple memory leaks, null checks, and error checks\n * Validate peer public key in DH key exchange\n * Avoid remote window overflow\n * Avoid off-by-one overflow during kbdint authentication\n * Avoid logging uninitialized sequence numbers\n * Avoid double conversion of SFTP version number\n * Send correct SFTP server version number\n * Avoid handling repeated SFTP INIT messages\n * Harmonize return values from SFTP server callbacks\n\n- Update %suse_version checks for SLES 16.x (jsc#PED-15815)\n","status":"published","published":"2026-07-25T17:15:12Z","modified":"2026-07-29T18:24:23.239513383Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:22956-1","title":"Security update for libssh","description":"This update for libssh fixes the following issues:\n\n- CVE-2026-15370: stack buffer overflow in SFTP server longname construction (bsc#1272162).\n- CVE-2026-59843: denial of service via zero advertised channel packet size (bsc#1272164).\n- CVE-2026-59844: denial of service via oversized SFTP read length (bsc#1272165).\n- CVE-2026-59845: denial of service via unchecked ProxyCommand fork() failure (bsc#1272166).\n- CVE-2026-59846: information disclosure via ProxyCommand %r username expansion (bsc#1272167).\n- CVE-2026-59847: integrity downgrade via OpenSSL AES-GCM tag verification (bsc#1272168).\n- CVE-2026-59848: denial of service via SFTP responses with unknown request IDs (bsc#1272169).\n- CVE-2026-59849: denial of service via automatic certificate authentication loop (bsc#1272170).\n- CVE-2026-59850: use-after-free via data callbacks on closed channels (bsc#1272171).\n\nChanges for libssh:\n\n- Update to 0.11.5:\n\n * Zero-initialize every ssh_string\n * Fix compatibility with C23 / gcc16\n * Fix multiple memory leaks, null checks, and error checks\n * Validate peer public key in DH key exchange\n * Avoid remote window overflow\n * Avoid off-by-one overflow during kbdint authentication\n * Avoid logging uninitialized sequence numbers\n * Avoid double conversion of SFTP version number\n * Send correct SFTP server version number\n * Avoid handling repeated SFTP INIT messages\n * Harmonize return values from SFTP server callbacks\n\n- Update %suse_version checks for SLES 16.x (jsc#PED-15815)\n","status":"published","published":"2026-07-25T17:15:12Z","modified":"2026-07-29T18:24:23.609905285Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23056-1","title":"Security update for libssh","description":"This update for libssh fixes the following issues:\n\n- CVE-2026-3731: denial of Service via out-of-bounds read in SFTP extension name handler (bsc#1259377).\n- CVE-2026-59843: denial of service via zero advertised channel packet size (bsc#1272164).\n- CVE-2026-59844: denial of service via oversized SFTP read length (bsc#1272165).\n- CVE-2026-59845: denial of service via unchecked ProxyCommand fork() failure (bsc#1272166).\n- CVE-2026-59846: information disclosure via ProxyCommand %r username expansion (bsc#1272167).\n- CVE-2026-59847: integrity downgrade via OpenSSL AES-GCM tag verification (bsc#1272168).\n- CVE-2026-59848: denial of service via SFTP responses with unknown request IDs (bsc#1272169).\n- CVE-2026-59850: use-after-free via data callbacks on closed channels (bsc#1272171).\n","status":"published","published":"2026-08-06T11:02:18Z","modified":"2026-08-12T18:23:40.37930639Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23168-1","title":"Security update for libssh","description":"This update for libssh fixes the following issues\n\n- CVE-2026-59843: denial of service via zero advertised channel packet size (bsc#1272164).\n- CVE-2026-59844: denial of service via oversized SFTP read length (bsc#1272165).\n- CVE-2026-59845: denial of service via unchecked ProxyCommand fork() failure (bsc#1272166).\n- CVE-2026-59846: information disclosure via ProxyCommand %r username expansion (bsc#1272167).\n- CVE-2026-59847: integrity downgrade via OpenSSL AES-GCM tag verification (bsc#1272168).\n- CVE-2026-59848: denial of service via SFTP responses with unknown request IDs (bsc#1272169).\n- CVE-2026-59850: use-after-free via data callbacks on closed channels (bsc#1272171).\n","status":"published","published":"2026-08-06T11:46:39Z","modified":"2026-08-22T18:23:33.406050738Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:3302-1","title":"Security update for libssh","description":"This update for libssh fixes the following issues\n\n- CVE-2026-3731: denial of service via out-of-bounds read in SFTP extension name handler (bsc#1259377).\n- CVE-2026-59843: denial of service via zero advertised channel packet size (bsc#1272164).\n- CVE-2026-59844: denial of service via oversized SFTP read length (bsc#1272165).\n- CVE-2026-59845: denial of service via unchecked ProxyCommand fork() failure (bsc#1272166).\n- CVE-2026-59846: information disclosure via ProxyCommand %r username expansion (bsc#1272167).\n- CVE-2026-59847: integrity downgrade via OpenSSL AES-GCM tag verification (bsc#1272168).\n- CVE-2026-59848: denial of service via SFTP responses with unknown request IDs (bsc#1272169).\n- CVE-2026-59850: use-after-free via data callbacks on closed channels (bsc#1272171).\n","status":"published","published":"2026-07-27T17:09:28Z","modified":"2026-07-28T10:00:09.184487488Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3330-1","title":"Security update for libssh","description":"This update for libssh fixes the following issues:\n\n- CVE-2026-59843: denial of service via zero advertised channel packet size (bsc#1272164).\n- CVE-2026-59844: denial of service via oversized SFTP read length (bsc#1272165).\n- CVE-2026-59845: denial of service via unchecked ProxyCommand fork() failure (bsc#1272166).\n- CVE-2026-59846: information disclosure via ProxyCommand %r username expansion (bsc#1272167).\n- CVE-2026-59847: integrity downgrade via OpenSSL AES-GCM tag verification (bsc#1272168).\n- CVE-2026-59848: denial of service via SFTP responses with unknown request IDs (bsc#1272169).\n- CVE-2026-59850: use-after-free via data callbacks on closed channels (bsc#1272171).\n","status":"published","published":"2026-07-28T09:36:03Z","modified":"2026-07-29T18:24:24.609217576Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3463-1","title":"Security update for libssh","description":"This update for libssh fixes the following issues:\n\n- CVE-2026-59843: denial of service via zero advertised channel packet size (bsc#1272164).\n- CVE-2026-59844: denial of service via oversized SFTP read length (bsc#1272165).\n- CVE-2026-59845: denial of service via unchecked ProxyCommand fork() failure (bsc#1272166).\n- CVE-2026-59846: information disclosure via ProxyCommand %r username expansion (bsc#1272167).\n- CVE-2026-59847: integrity downgrade via OpenSSL AES-GCM tag verification (bsc#1272168).\n- CVE-2026-59848: denial of service via SFTP responses with unknown request IDs (bsc#1272169).\n- CVE-2026-59850: use-after-free via data callbacks on closed channels (bsc#1272171).\n","status":"published","published":"2026-08-03T12:18:45Z","modified":"2026-08-04T11:45:08.999402089Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"USN-8699-1","title":"libssh vulnerabilities","description":"It was discovered that libssh had a stack buffer overflow in its SFTP\nserver when constructing directory listing entries for long filenames. An\nattacker could possibly use this issue to cause libssh to crash or execute\narbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-15370)\n\nIt was discovered that libssh did not correctly handle SSH channel open\nmessages advertising a zero maximum packet size. An authenticated remote\nattacker could possibly use this issue to cause libssh to consume excessive\nCPU resources, leading to a denial of service. (CVE-2026-59843)\n\nIt was discovered that libssh did not correctly limit SFTP read request\nlengths in its server implementation. An authenticated remote attacker\ncould possibly use this issue to cause libssh to allocate excessive memory,\nleading to a denial of service. This issue only affected Ubuntu 26.04 LTS.\n(CVE-2026-59844)\n\nIt was discovered that libssh did not correctly handle ProxyCommand fork()\nfailures. A local attacker could possibly use this issue to cause a denial\nof service. (CVE-2026-59845)\n\nIt was discovered that libssh did not correctly sanitize shell\nmetacharacters when expanding usernames in ProxyCommand strings. An\nattacker could possibly use this issue to obtain sensitive information.\n(CVE-2026-59846)\n\nIt was discovered that libssh had incorrect AES-GCM tag verification when\nbuilt with the OpenSSL backend. A machine-in-the-middle attacker could\npossibly use this issue to modify encrypted traffic without detection.\n(CVE-2026-59847)\n\nIt was discovered that libssh did not correctly handle SFTP server\nresponses for unknown request IDs. An attacker could possibly use this\nissue to cause libssh to use excessive memory, leading to a denial of\nservice. (CVE-2026-59848)\n\nIt was discovered that libssh had logic errors in certificate-based\nauthentication that could cause clients to loop indefinitely when\ncertificates were rejected. An attacker could possibly use this issue to\ncause a denial of service. This issue only affected Ubuntu 26.04 LTS.\n(CVE-2026-59849)\n\nIt was discovered that libssh could invoke data callbacks on channels after\nthey had been closed. An attacker could possibly use this issue to cause\nlibssh to crash or execute arbitrary code. (CVE-2026-59850)","status":"published","published":"2026-08-31T11:58:26Z","modified":"2026-08-31T17:26:25.877103559Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}