CVE-2026-59845: Libssh: libssh: denial of service via unchecked proxycommand fork() failure
A flaw was found in libssh client-side ProxyCommand handling. In sshsocketconnectproxycommand() in src/socket.c, the return value of fork() was not checked before being stored as the proxy child PID. If fork() fails, the value -1 can be retained in state and later used during cleanup, causing signals to be sent across the caller's accessible process tree. In deployments that use ProxyCommand, this can lead to local denial of service.
Other sources
A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service.
— MITRE
Libssh: libssh: denial of service via unchecked proxycommand fork() failure
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.10.6-9
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59845?
CVE-2026-59845 has a medium severity rating of 5.3.
What is the impact of CVE-2026-59845?
CVE-2026-59845 can lead to a denial of service due to an unchecked fork() failure in libssh.
How do I fix CVE-2026-59845?
To fix CVE-2026-59845, ensure you are using an updated version of libssh that addresses this vulnerability.
What software is affected by CVE-2026-59845?
CVE-2026-59845 affects the libssh software.
What causes the vulnerability in CVE-2026-59845?
The vulnerability in CVE-2026-59845 is caused by the failure to check the return value of fork() during ProxyCommand handling.