Affected: AlmaLinux:10: libssh, AlmaLinux:10: libssh-config, AlmaLinux:10: libssh-devel

libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.

Security Fix(es):

* libssh: libssh: information disclosure via short GSSAPI Curve25519 public key (CVE-2026-59842) * libssh: libssh: denial of service via zero advertised channel packet size (CVE-2026-59843) * libssh: libssh: denial of service via oversized SFTP read length (CVE-2026-59844) * libssh: libssh: denial of service via unchecked ProxyCommand fork() failure (CVE-2026-59845) * libssh: libssh: information disclosure via ProxyCommand %r username expansion (CVE-2026-59846) * libssh: libssh: integrity downgrade via OpenSSL AES-GCM tag verification (CVE-2026-59847) * libssh: libssh: denial of service via SFTP responses with unknown request IDs (CVE-2026-59848) * libssh: libssh: denial of service via automatic certificate authentication loop (CVE-2026-59849) * libssh: libssh: use-after-free via data callbacks on closed channels (CVE-2026-59850) * libssh: libssh: authentication bypass via missing GSSAPI principal check (CVE-2026-59851) * libssh: libssh: stack buffer overflow in SFTP server longname construction (CVE-2026-15370)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected: Alpaquita:23: libssh, Alpaquita:25: libssh, Alpaquita:stream: libssh

A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when configured certificates are missing or repeatedly rejected by a server, leading to denial of service.

A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when configured certificates are missing or repeatedly rejected by a server, leading to denial of service.

libssh-config-0.11.5-1.1 on GA media

libssh: libssh: information disclosure via short GSSAPI Curve25519 public key libssh: libssh: denial of service via zero advertised channel packet size libssh: libssh: denial of service via oversized SFTP read length libssh: libssh: denial of service via unchecked ProxyCommand fork() failure libssh: libssh: information disclosure via ProxyCommand %r username expansion libssh: libssh: integrity downgrade via OpenSSL AES-GCM tag verification libssh: libssh: denial of service via SFTP responses with unknown request IDs libssh: libssh: denial of service via automatic certificate authentication loop libssh: libssh: use-after-free via data callbacks on closed channels libssh: libssh: authentication bypass via missing GSSAPI principal check

Affected: Rocky Linux:10: libssh

libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.

Security Fix(es):

* libssh: libssh: information disclosure via short GSSAPI Curve25519 public key (CVE-2026-59842)

* libssh: libssh: denial of service via zero advertised channel packet size (CVE-2026-59843)

* libssh: libssh: denial of service via oversized SFTP read length (CVE-2026-59844)

* libssh: libssh: denial of service via unchecked ProxyCommand fork() failure (CVE-2026-59845)

* libssh: libssh: information disclosure via ProxyCommand %r username expansion (CVE-2026-59846)

* libssh: libssh: integrity downgrade via OpenSSL AES-GCM tag verification (CVE-2026-59847)

* libssh: libssh: denial of service via SFTP responses with unknown request IDs (CVE-2026-59848)

* libssh: libssh: denial of service via automatic certificate authentication loop (CVE-2026-59849)

* libssh: libssh: use-after-free via data callbacks on closed channels (CVE-2026-59850)

* libssh: libssh: authentication bypass via missing GSSAPI principal check (CVE-2026-59851)

* libssh: libssh: stack buffer overflow in SFTP server longname construction (CVE-2026-15370)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Security update for libssh

Affected: Ubuntu:26.04:LTS: libssh

A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when configured certificates are missing or repeatedly rejected by a server, leading to denial of service.

Ein Angreifer kann mehrere Schwachstellen in libssh ausnutzen, um erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Angriff auszulösen und Daten zu manipulieren.