RHSA-2026:62218: Moderate: libssh security update
libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.Security Fix(es): libssh: libssh: denial of service via zero advertised channel packet size (CVE-2026-59843) libssh: libssh: denial of service via oversized SFTP read length (CVE-2026-59844) libssh: libssh: denial of service via unchecked ProxyCommand fork() failure (CVE-2026-59845) libssh: libssh: information disclosure via ProxyCommand %r username expansion (CVE-2026-59846) libssh: libssh: integrity downgrade via OpenSSL AES-GCM tag verification (CVE-2026-59847) libssh: libssh: denial of service via SFTP responses with unknown request IDs (CVE-2026-59848) libssh: libssh: use-after-free via data callbacks on closed channels (CVE-2026-59850) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/libsshto a version that resolves this vulnerability.Fixed in 0.9.6-17.el8_10 - Upgrade
Upgrade
redhat/libssh-configto a version that resolves this vulnerability.Fixed in 0.9.6-17.el8_10 - Upgrade
Upgrade
redhat/libssh-debuginfoto a version that resolves this vulnerability.Fixed in 0.9.6-17.el8_10 - Upgrade
Upgrade
redhat/libssh-debugsourceto a version that resolves this vulnerability.Fixed in 0.9.6-17.el8_10 - Upgrade
Upgrade
redhat/libssh-develto a version that resolves this vulnerability.Fixed in 0.9.6-17.el8_10 - Upgrade
Upgrade
redhat/libsshto a version that resolves this vulnerability.Fixed in 0.9.6-17.el8_10.aa - Upgrade
Upgrade
redhat/libssh-debuginfoto a version that resolves this vulnerability.Fixed in 0.9.6-17.el8_10.aa - Upgrade
Upgrade
redhat/libssh-debugsourceto a version that resolves this vulnerability.Fixed in 0.9.6-17.el8_10.aa - Upgrade
Upgrade
redhat/libssh-develto a version that resolves this vulnerability.Fixed in 0.9.6-17.el8_10.aa
Event History
Frequently Asked Questions
Which applications are potentially exposed to these issues?
Applications that use libssh to implement SSH client or server functionality may be affected. The listed fixes also specifically involve SFTP handling, ProxyCommand processing, SSH channel callbacks, and OpenSSL AES-GCM tag verification.
What attacker-controlled conditions are involved in the denial-of-service issues?
The described denial-of-service conditions involve a zero advertised channel packet size, an oversized SFTP read length, SFTP responses containing unknown request IDs, and an unchecked ProxyCommand fork() failure. Whether an attacker can trigger a given condition depends on whether the application uses the affected libssh feature or protocol path.
Are ProxyCommand users subject to risks beyond denial of service?
Yes. One listed issue discloses information through ProxyCommand %r username expansion, while another can cause denial of service when ProxyCommand fork() failures are unchecked. These risks are relevant where the application uses libssh ProxyCommand functionality.
Does the update address an integrity-related issue?
Yes. CVE-2026-59847 is described as an integrity downgrade involving OpenSSL AES-GCM tag verification. The provided information does not specify affected configurations or exploitation prerequisites.
Which packages are included in this advisory?
The advisory lists redhat/libssh, redhat/libssh-debuginfo, redhat/libssh-debugsource, redhat/libssh-devel, and redhat/libssh-config.