CVE Catalog
CVE-2026-59842
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk0.42%
36th percentile - higher than 36% of all known CVEs
Summary
In libssh, during server-side GSSAPI key exchange, a short Curve25519 public key is copied without proper length validation, causing an out-of-bounds heap read.
Risk Assessment
A remote unauthenticated attacker can disclose small amounts of server memory, potentially leaking sensitive data.
Recommendation
Update libssh to a patched version.
Original NVD description (English source)
A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length is copied without proper length validation, leading to an out-of-bounds heap read. This could allow a remote unauthenticated attacker to disclose small amounts of server memory.