CVE-2026-0966
HIGH
MEDIUM
Priority: 0.05
BB Relevance:
77/100
Published: 2026-03-26
Modified: 2026-11-05
First seen: 2026-11-02
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
S:
Unchanged
C:
None
I:
Low
A:
High
Description
A flaw was found in libssh. The API function `ssh_get_hexa()` is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI (Generic Security Service Application Program Interface) authentication if the server's logging verbosity is set to `SSH_LOG_PACKET (3)` or higher. Successful exploitation could lead to a self-Denial of Service of the per-connection daemon process.
Weakness Classification (1)
Affected Software (6)
| Vendor | Product | Version |
|---|---|---|
| libssh | libssh | < 0.11.4 |
| redhat | enterprise_linux | 8.0 |
| redhat | enterprise_linux | 9.0 |
| redhat | enterprise_linux | 10.0 |
| redhat | hardened_images | - |
| redhat | openshift_container_platform | 4.0 |
References & Advisories (6)
vendor-advisory
x_refsource_REDHAT
vendor-advisory
x_refsource_REDHAT
vendor-advisory
x_refsource_REDHAT
vdb-entry
x_refsource_REDHAT
issue-tracking
x_refsource_REDHAT