RHSA-2026:18160MediumCVSS 6.5

Red Hat Security Advisory: libssh security update

Published
May 19, 2026
Last Modified
September 1, 2026

🔗 CVE IDs covered (5)

CVE-2026-0964 →CVE-2026-0965 →CVE-2026-0966 →CVE-2026-0967 →CVE-2026-0968 →

📋 Description

CVE-2026-0964 — libssh: Improper sanitation of paths received from SCP servers CVE-2026-0965 — libssh: libssh: Denial of Service via improper configuration file handling CVE-2026-0966 — libssh: libssh: Denial of Service via zero-length input in ssh_get_hexa() CVE-2026-0967 — libssh: libssh: Denial of Service via inefficient regular expression processing CVE-2026-0968 — libssh: libssh: Denial of Service due to malformed SFTP message

🎯 Affected products28

  • Red Hat Enterprise Linux AppStream (v. 10)
  • Red Hat Enterprise Linux BaseOS (v. 10)
  • libssh-0:0.12.0-2.el10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • libssh-0:0.12.0-2.el10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • libssh-0:0.12.0-2.el10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • libssh-0:0.12.0-2.el10.src as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • libssh-0:0.12.0-2.el10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • libssh-config-0:0.12.0-2.el10.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • libssh-debuginfo-0:0.12.0-2.el10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libssh-debuginfo-0:0.12.0-2.el10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • libssh-debuginfo-0:0.12.0-2.el10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libssh-debuginfo-0:0.12.0-2.el10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • libssh-debuginfo-0:0.12.0-2.el10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libssh-debuginfo-0:0.12.0-2.el10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • libssh-debuginfo-0:0.12.0-2.el10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libssh-debuginfo-0:0.12.0-2.el10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • libssh-debugsource-0:0.12.0-2.el10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libssh-debugsource-0:0.12.0-2.el10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • libssh-debugsource-0:0.12.0-2.el10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libssh-debugsource-0:0.12.0-2.el10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • libssh-debugsource-0:0.12.0-2.el10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libssh-debugsource-0:0.12.0-2.el10.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • libssh-debugsource-0:0.12.0-2.el10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libssh-debugsource-0:0.12.0-2.el10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)
  • libssh-devel-0:0.12.0-2.el10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libssh-devel-0:0.12.0-2.el10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libssh-devel-0:0.12.0-2.el10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • libssh-devel-0:0.12.0-2.el10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Do not use SCP! SCP is deprecated for several years and will be removed in future releases! If you have to, the application MUST validate the path returned from `ssh_scp_request_get_filename()` is the path the application requested. The libssh does not do any writing in this case. Workaround: Ensure the client and server are using only regular files as configuration. Workaround: To mitigate this issue, consider disabling GSSAPI authentication if it is not required, or reduce the `LogLevel` in the `sshd_config` file to a value lower than `SSH_LOG_PACKET` (e.g., `INFO`). To disable GSSAPI authentication, add or modify the following line in `/etc/ssh/sshd_config`: `GSSAPIAuthentication no` To reduce logging verbosity, add or modify the following line in `/etc/ssh/sshd_config`: `LogLevel INFO` After making changes to `sshd_config`, the `sshd` service must be restarted for the changes to take effect. This may temporarily interrupt active SSH sessions. Workaround: Avoid using complex patterns in configuration files and known_hosts.

🔗 References (12)