CVE-2026-0966: Libssh: libssh: denial of service via zero-length input in ssh_get_hexa()
A flaw was found in libssh. The API function sshgethexa() is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI (Generic Security Service Application Program Interface) authentication if the server's logging verbosity is set to SSHLOGPACKET (3) or higher. Successful exploitation could lead to a self-Denial of Service of the per-connection daemon process.
Other sources
Libssh: buffer underflow in sshgethexa() on invalid input
— Microsoft
The API function sshgethexa() is vulnerable, when 0-lenght input is provided to this function. This function is used internally in sshgetfingerprinthash() and sshprinthexa() (deprecated), which is vulnerable to the same input (length is provided by the calling application).
The function is also used internally in the gssapi code for logging the OIDs received by the server during GSSAPI authentication. This could be triggered remotely, when the server allows GSSAPI authentication and logging verbosity is set at least to SSHLOGPACKET (3). This could cause self-DoS of the per-connection daemon process.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.10.6-6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.10.6-7 - Upgrade
Upgrade
alpine/libsshto a version that resolves this vulnerability.Fixed in 0.11.4-r0 - Upgrade
Upgrade
alpine/libsshto a version that resolves this vulnerability.Fixed in 0.12.0-r0 - Upgrade
Upgrade
debian/libsshto a version that resolves this vulnerability.Fixed in 0.10.6-0+deb12u3Fixed in 0.11.5-0+deb13u1Fixed in 0.12.2-1 - Upgrade
Upgrade
debian/libsshto a version that resolves this vulnerability.Fixed in 0.10.6-0+deb12u3 - Upgrade
Upgrade
debian/libsshto a version that resolves this vulnerability.Fixed in 0.11.5-0+deb13u1 - Upgrade
Upgrade
debian/libsshto a version that resolves this vulnerability.Fixed in 0.12.0-1