CVE-2026-0967
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A flaw was found in libssh. A remote attacker, by controlling client configuration files or known_hosts files, could craft specific hostnames that when processed by the `match_pattern()` function can lead to inefficient regular expression backtracking. This can cause timeouts and resource exhaustion, resulting in a Denial of Service (DoS) for the client.
Risk Assessment
An attacker can cause client-side resource exhaustion, potentially leading to unavailability of SSH services for users.
Recommendation
Update libssh to a patched version and be cautious when using untrusted configuration and known_hosts files.
Other vulnerabilities in libssh
See all- CVE-2015-3146High
Versions of libssh before 0.6.5 have a state validation issue in the handling of SSH_MSG_NEWKEYS and SSH_MSG_KEXDH_REPLY packets, which can lead to system crashes.
- CVE-2026-59851High
Vulnerability in the libssh library on servers with GSSAPIKeyExchange enabled. The gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.
- CVE-2026-59850Medium
In the libssh library, if data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions.
- CVE-2026-59849Low
A logic error in libssh's automatic certificate-based public key authentication causes libssh clients to loop indefinitely when configured certificates are missing or repeatedly rejected by a server, leading to denial of service.
- CVE-2026-59848Medium
Vulnerability in libssh. A malicious SFTP server can send responses for unknown request IDs, causing unbounded memory growth and client-side denial of service.
- CVE-2026-59847Medium
A flaw in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection.
- CVE-2026-59846Low
A flaw in libssh: a malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.
- CVE-2026-59845Medium
In libssh, when ProxyCommand is used, an unchecked fork() failure can result in storing PID -1. During cleanup, signals may be sent to processes in the caller's process tree, causing local denial of service.
- CVE-2026-59844Medium
A flaw in libssh: a remote authenticated client can issue SFTP_READ requests with an arbitrarily large length, causing the SFTP server to allocate excessive memory and potentially exhaust it.
- CVE-2026-59843Medium
A flaw in libssh: a remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing infinite channel write loops and CPU exhaustion.
Original NVD description (English source)
A flaw was found in libssh. A remote attacker, by controlling client configuration files or known_hosts files, could craft specific hostnames that when processed by the `match_pattern()` function can lead to inefficient regular expression backtracking. This can cause timeouts and resource exhaustion, resulting in a Denial of Service (DoS) for the client.