CVE-2026-59845 Details
Description
A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service.
A denial-of-service vulnerability has been identified in libssh, specifically in the handling of the ProxyCommand feature. The issue arises because the return value of the fork() function is not properly checked before being stored as the process ID. If the fork() call fails, it can store an invalid process ID of -1. During the cleanup process, this can result in signals being erroneously sent across the caller's accessible process tree, disrupting local system availability. This vulnerability affects all versions of libssh prior to the fix.
To address this vulnerability, it is recommended to avoid using the ProxyCommand feature in libssh client configurations. This will prevent the vulnerable code path from being activated, thereby eliminating the risk of a local denial-of-service condition.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-390 | Detection of Error Condition Without Action | CISA-ADP |
| CWE-390 | Detection of Error Condition Without Action | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libssh libssh | All versions |
CPE
Remediation
| |
| redhat hardened images | All versions |
CPE
Remediation
| |
| redhat enterprise linux | 8.0 9.0 10.0 |
CPE
Remediation
| |
Change History
8 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 1, 2026 | CVE Modified | [email protected] |
| Sep 1, 2026 | CVE Modified | [email protected] |
| Aug 17, 2026 | CVE Modified | [email protected] |
| Aug 11, 2026 | CVE Modified | [email protected] |
| Jul 30, 2026 | Initial Analysis | [email protected] |
| Jul 23, 2026 | CVE Modified | CISA-ADP |
| Jul 22, 2026 | CVE Modified | [email protected] |
| Jul 21, 2026 | New CVE Received | [email protected] |