RHSA-2026:18683MediumCVSS 6.5

Red Hat Security Advisory: libssh security update

Published
May 19, 2026
Last Modified
September 1, 2026

🔗 CVE IDs covered (10)

CVE-2025-4878 →CVE-2025-5351 →CVE-2025-8114 →CVE-2025-8277 →CVE-2026-0964 →CVE-2025-4877 →CVE-2026-0965 →CVE-2026-0966 →CVE-2026-0967 →CVE-2026-0968 →

📋 Description

CVE-2025-4877 — libssh: Write beyond bounds in binary to base64 conversion functions CVE-2025-4878 — libssh: Use of uninitialized variable in privatekey_from_file() CVE-2025-5351 — libssh: Double Free Vulnerability in libssh Key Export Functions CVE-2025-8114 — libssh: NULL Pointer Dereference in libssh KEX Session ID Calculation CVE-2025-8277 — libssh: Memory Exhaustion via Repeated Key Exchange in libssh CVE-2026-0964 — libssh: Improper sanitation of paths received from SCP servers CVE-2026-0965 — libssh: libssh: Denial of Service via improper configuration file handling CVE-2026-0966 — libssh: libssh: Denial of Service via zero-length input in ssh_get_hexa() CVE-2026-0967 — libssh: libssh: Denial of Service via inefficient regular expression processing CVE-2026-0968 — libssh: libssh: Denial of Service due to malformed SFTP message

🎯 Affected products34

  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat Enterprise Linux BaseOS (v. 9)
  • libssh-0:0.10.4-18.el9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • libssh-0:0.10.4-18.el9.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • libssh-0:0.10.4-18.el9.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • libssh-0:0.10.4-18.el9.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • libssh-0:0.10.4-18.el9.src as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • libssh-0:0.10.4-18.el9.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • libssh-config-0:0.10.4-18.el9.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • libssh-debuginfo-0:0.10.4-18.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • libssh-debuginfo-0:0.10.4-18.el9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • libssh-debuginfo-0:0.10.4-18.el9.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • libssh-debuginfo-0:0.10.4-18.el9.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • libssh-debuginfo-0:0.10.4-18.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • libssh-debuginfo-0:0.10.4-18.el9.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • libssh-debuginfo-0:0.10.4-18.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • libssh-debuginfo-0:0.10.4-18.el9.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • libssh-debuginfo-0:0.10.4-18.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • libssh-debuginfo-0:0.10.4-18.el9.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • libssh-debugsource-0:0.10.4-18.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • libssh-debugsource-0:0.10.4-18.el9.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • libssh-debugsource-0:0.10.4-18.el9.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • libssh-debugsource-0:0.10.4-18.el9.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • libssh-debugsource-0:0.10.4-18.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • libssh-debugsource-0:0.10.4-18.el9.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • libssh-debugsource-0:0.10.4-18.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • libssh-debugsource-0:0.10.4-18.el9.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • libssh-debugsource-0:0.10.4-18.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • libssh-debugsource-0:0.10.4-18.el9.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9)
  • libssh-devel-0:0.10.4-18.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • +4 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Administrators should apply vendor-supplied patches as soon as they become available. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. It is strongly advised to apply updated libssh packages once available to prevent memory exhaustion risks on client systems. Workaround: Do not use SCP! SCP is deprecated for several years and will be removed in future releases! If you have to, the application MUST validate the path returned from `ssh_scp_request_get_filename()` is the path the application requested. The libssh does not do any writing in this case. Workaround: Ensure the client and server are using only regular files as configuration. Workaround: To mitigate this issue, consider disabling GSSAPI authentication if it is not required, or reduce the `LogLevel` in the `sshd_config` file to a value lower than `SSH_LOG_PACKET` (e.g., `INFO`). To disable GSSAPI authentication, add or modify the following line in `/etc/ssh/sshd_config`: `GSSAPIAuthentication no` To reduce logging verbosity, add or modify the following line in `/etc/ssh/sshd_config`: `LogLevel INFO` After making changes to `sshd_config`, the `sshd` service must be restarted for the changes to take effect. This may temporarily interrupt active SSH sessions. Workaround: Avoid using complex patterns in configuration files and known_hosts.

🔗 References (15)