CVE-2026-59843 Details
Description
A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later channel writes to loop indefinitely and consume CPU, leading to denial of service.
A denial-of-service vulnerability has been identified in libssh. The issue arises when a remote authenticated peer advertises a maximum packet size of zero in SSH_MSG_CHANNEL_OPEN. This misconfiguration causes subsequent channel write operations to enter an infinite loop, consuming CPU resources and leading to a denial-of-service condition. The vulnerability is present in all versions of libssh prior to the fix, allowing remote authenticated peers to exploit this flaw by sending channel open messages with a zero packet size.
Users can refer to the Red Hat Security Errata for guidance on applying the necessary updates. For Red Hat Enterprise Linux 8, 9, and 10, the fix is currently deferred.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | CISA-ADP |
| CWE-835 | Loop with Unreachable Exit Condition ('Infinite Loop') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libssh libssh | All versions |
CPE
Remediation
| |
| redhat hardened images | All versions |
CPE
Remediation
| |
| redhat enterprise linux | 8.0 9.0 10.0 |
CPE
Remediation
| |
Change History
8 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 1, 2026 | CVE Modified | [email protected] |
| Sep 1, 2026 | CVE Modified | [email protected] |
| Aug 17, 2026 | CVE Modified | [email protected] |
| Aug 12, 2026 | CVE Modified | [email protected] |
| Jul 30, 2026 | Initial Analysis | [email protected] |
| Jul 22, 2026 | CVE Modified | [email protected] |
| Jul 21, 2026 | CVE Modified | CISA-ADP |
| Jul 21, 2026 | New CVE Received | [email protected] |