RHSA-2026:62217: Moderate: libssh security update
libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.Security Fix(es): libssh: libssh: denial of service via zero advertised channel packet size (CVE-2026-59843) libssh: libssh: denial of service via oversized SFTP read length (CVE-2026-59844) libssh: libssh: denial of service via unchecked ProxyCommand fork() failure (CVE-2026-59845) libssh: libssh: information disclosure via ProxyCommand %r username expansion (CVE-2026-59846) libssh: libssh: integrity downgrade via OpenSSL AES-GCM tag verification (CVE-2026-59847) libssh: libssh: denial of service via SFTP responses with unknown request IDs (CVE-2026-59848) libssh: libssh: use-after-free via data callbacks on closed channels (CVE-2026-59850) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/libsshto a version that resolves this vulnerability.Fixed in 0.10.4-19.el9_8 - Upgrade
Upgrade
redhat/libssh-configto a version that resolves this vulnerability.Fixed in 0.10.4-19.el9_8 - Upgrade
Upgrade
redhat/libssh-debuginfoto a version that resolves this vulnerability.Fixed in 0.10.4-19.el9_8 - Upgrade
Upgrade
redhat/libssh-debugsourceto a version that resolves this vulnerability.Fixed in 0.10.4-19.el9_8 - Upgrade
Upgrade
redhat/libssh-develto a version that resolves this vulnerability.Fixed in 0.10.4-19.el9_8 - Upgrade
Upgrade
redhat/libsshto a version that resolves this vulnerability.Fixed in 0.10.4-19.el9_8.aa - Upgrade
Upgrade
redhat/libssh-debuginfoto a version that resolves this vulnerability.Fixed in 0.10.4-19.el9_8.aa - Upgrade
Upgrade
redhat/libssh-debugsourceto a version that resolves this vulnerability.Fixed in 0.10.4-19.el9_8.aa - Upgrade
Upgrade
redhat/libssh-develto a version that resolves this vulnerability.Fixed in 0.10.4-19.el9_8.aa - Upgrade
Upgrade
libsshto a version that resolves this vulnerability.Patch CVE-2026-59843 - Upgrade
Upgrade
libsshto a version that resolves this vulnerability.Patch CVE-2026-59844 - Upgrade
Upgrade
libsshto a version that resolves this vulnerability.Patch CVE-2026-59845 - Upgrade
Upgrade
libsshto a version that resolves this vulnerability.Patch CVE-2026-59846 - Upgrade
Upgrade
libsshto a version that resolves this vulnerability.Patch CVE-2026-59847 - Upgrade
Upgrade
libsshto a version that resolves this vulnerability.Patch CVE-2026-59848 - Upgrade
Upgrade
libsshto a version that resolves this vulnerability.Patch CVE-2026-59850
Event History
Frequently Asked Questions
Which libssh uses are most relevant to these flaws?
Applications that use libssh to implement SSH client or server functionality are relevant. The listed issues specifically involve SSH channels, SFTP handling, ProxyCommand behavior, data callbacks, and OpenSSL AES-GCM tag verification.
What types of impact are covered by this update?
The update addresses multiple denial-of-service conditions, including malformed channel packet sizes, SFTP read lengths and response IDs, and ProxyCommand fork failures. It also addresses an information disclosure issue in ProxyCommand username expansion, a use-after-free condition involving callbacks on closed channels, and an integrity downgrade related to OpenSSL AES-GCM tag verification.
How can I determine whether installed packages are in scope?
Check for installed libssh packages, including libssh, libssh-debuginfo, libssh-debugsource, and libssh-devel. The advisory also identifies affected Red Hat Enterprise Linux update channels for Power little endian, x86_64 SAP Solutions, IBM z Systems Extended Life Cycle, and ARM 64 Extended Update Support.