CVE-2026-59843: Libssh: libssh: denial of service via zero advertised channel packet size
A flaw was found in libssh channel handling. In sshpacketchannelopen() in src/messages.c and sshpacketchannelopenconf() in src/channels.c, the implementation accepts a peer-controlled maximum packet size of 0 in channel open messages. That zero value is stored in channel state and later reaches channelwritecommon(), where forward progress depends on the remote maximum packet size being positive; with 0, the remaining length is never reduced and the write path loops indefinitely, consuming CPU and causing denial of service. A remote authenticated peer can trigger this by advertising a zero maximum packet size in SSHMSGCHANNELOPEN or SSHMSGCHANNELOPENCONFIRMATION.
Other sources
A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSHMSGCHANNELOPEN, causing later channel writes to loop indefinitely and consume CPU, leading to denial of service.
— MITRE
Libssh: libssh: denial of service via zero advertised channel packet size
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.10.6-9
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59843?
The severity of CVE-2026-59843 is medium with a CVSS score of 6.5.
How do I fix CVE-2026-59843?
To mitigate CVE-2026-59843, update libssh to the latest version provided by your distribution or apply relevant patches.
What type of vulnerability is CVE-2026-59843?
CVE-2026-59843 is a denial of service vulnerability affecting the channel handling in libssh.
Which software is affected by CVE-2026-59843?
CVE-2026-59843 affects Red Hat Enterprise Linux, specifically the libssh library.
What impact does CVE-2026-59843 have?
CVE-2026-59843 can lead to a denial of service by allowing a peer to send a zero-sized packet, causing affected systems to become unresponsive.