RHSA-2026:7067MediumCVSS 7.8

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
April 8, 2026
Last Modified
November 5, 2026

🔗 CVE IDs covered (3)

CVE-2026-0966 →CVE-2026-3731 →CVE-2025-14821 →

📋 Description

CVE-2025-14821 — libssh: libssh: Insecure default configuration leads to local man-in-the-middle attacks on Windows CVE-2026-0966 — libssh: libssh: Denial of Service via zero-length input in ssh_get_hexa() CVE-2026-3731 — libssh: libssh: Denial of Service via out-of-bounds read in SFTP extension name handler

🎯 Affected products8

  • Red Hat Hardened Images
  • libssh-0:0.12.0-1.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • libssh-0:0.12.0-1.1.hum1@src as a component of Red Hat Hardened Images
  • libssh-0:0.12.0-1.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • libssh-config-0:0.12.0-1.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • libssh-config-0:0.12.0-1.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • libssh-devel-0:0.12.0-1.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • libssh-devel-0:0.12.0-1.1.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Applications using libssh should avoid passing zero-length input to ssh_get_hexa(), ssh_get_fingerprint_hash(), and ssh_print_hexa(). For the remotely reachable GSSAPI authentication path, disable GSSAPI authentication in the affected libssh-based application if it is not required, or configure that application's libssh logging verbosity below SSH_LOG_PACKET (3). These measures address the GSSAPI logging path; they do not prevent other callers from passing zero-length input to the affected functions. Configuration and any required restart depend on the application using libssh. Changing the host's OpenSSH sshd_config or restarting the OpenSSH sshd service is not a general mitigation for applications using libssh. Apply the relevant vendor update containing the fix. Upstream fixed this issue in libssh 0.11.4 and 0.12.0; distribution packages may include a backported fix.

🔗 References (7)