CVE-2026-59850: Libssh: libssh: use-after-free via data callbacks on closed channels
A flaw was found in libssh channel data handling. In channelrcvdata() in src/channels.c, incoming channel DATA messages could still be processed after the channel had already been marked as remotely closed. In SFTP-backed applications and other callback-driven consumers, this creates a path where data callbacks may observe channel-associated state after it has already been torn down or freed, leading to crashes and possible use-after-free conditions.
Other sources
A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions.
— MITRE
Libssh: libssh: use-after-free via data callbacks on closed channels
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.10.6-9
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59850?
CVE-2026-59850 has a high severity rating of 7.5.
How do I fix CVE-2026-59850?
To fix CVE-2026-59850, update libssh to the latest patched version provided by Red Hat.
What systems are affected by CVE-2026-59850?
CVE-2026-59850 affects Red Hat Enterprise Linux, libssh, and Red Hat Hardened Images.
What causes the vulnerability in CVE-2026-59850?
CVE-2026-59850 is caused by a use-after-free flaw in libssh's channel data handling.
What are the potential impacts of exploiting CVE-2026-59850?
Exploiting CVE-2026-59850 could lead to application crashes and unintended data exposure.