CVE-2026-59849
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A logic error in libssh's automatic certificate-based public key authentication causes libssh clients to loop indefinitely when configured certificates are missing or repeatedly rejected by a server, leading to denial of service.
Risk Assessment
An attacker can cause libssh clients to become unresponsive, preventing SSH connections and leading to service disruption.
Recommendation
Update the libssh library to a version containing a fix for the logic error in certificate handling.
Original NVD description (English source)
A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when configured certificates are missing or repeatedly rejected by a server, leading to denial of service.