CVE-2026-59849: Libssh: libssh: denial of service via automatic certificate authentication loop
A flaw was found in libssh automatic certificate-based public key authentication. In sshuserauthpublickeyauto() in src/auth.c, the iterator over certificate candidates was not advanced correctly when configured certificates were missing or repeatedly rejected by the server. Under specific non-default certificate configurations, this could cause the client to restart the same authentication attempts indefinitely, leading to denial of service.
Other sources
A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when configured certificates are missing or repeatedly rejected by a server, leading to denial of service.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59849?
CVE-2026-59849 has a severity rating of 7.5, classified as high.
What types of attacks are possible due to CVE-2026-59849?
CVE-2026-59849 can lead to a denial of service due to an automatic certificate authentication loop.
How do I fix CVE-2026-59849?
To mitigate CVE-2026-59849, ensure that the libssh is updated to the latest patched version that addresses this vulnerability.
Which software versions are affected by CVE-2026-59849?
CVE-2026-59849 affects libssh, Red Hat Hardened Images, and Red Hat Enterprise Linux.
What is the impact of CVE-2026-59849 on server security?
The impact of CVE-2026-59849 includes potential service disruptions due to an inability to authenticate certificates, leading to denial of service.