Skip to main content

Red Hat Enterprise Linux 10 CVE-2026-0965

| EUVDEUVD-2026-16328 LOW
External Control of File Name or Path (CWE-73)
2026-03-26 redhat
Denial Of Service Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Openshift Container Platform 4 Red Hat
3.3
CVSS 3.0 · Vendor: redhat
View

Vulnerability Assessment

Weakness
CWE
CWE-73
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File name/path control
Impact

The CVSS score of 3.3 with vector CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L indicates low overall severity. The attack vector is local (AV:L), attack complexity is low (AC:L), and low privileges (PR:L) are required, making this exploitable by unprivileged local users without user interaction. The impact is limited to availability (A:L), with no confidentiality or integrity compromise. The absence of a CISA KEV entry and no indication of publicly available exploit code suggest limited real-world exploitation activity. However, the low barrier to exploitation (local access with minimal privileges, no special configuration needed) means this poses a moderate operational risk in multi-tenant environments or systems where local user accounts are common. The DoS impact, while non-critical, could disrupt SSH functionality or system stability in availability-sensitive deployments.
Exploit ScenarioDerived

A local user on a Red Hat Enterprise Linux system with unprivileged account access crafts a malicious SSH configuration file that references dangerous paths such as block devices (/dev/sda) or large files (/dev/zero). When libssh parses this configuration during SSH service initialization or user SSH operations, it attempts to open these resources, causing the SSH process to hang or consume excessive I/O resources, resulting in denial of service to legitimate SSH connections. The attack requires only local filesystem write access and no special system configuration.
Monitor Track and reassess. Why: LOW severity (CVSS 0.1-3.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 26, 2026

libssh attempts to open arbitrary files during configuration parsing, allowing local attackers with limited privileges to trigger a denial of service by forcing access to dangerous files such as block devices or large system files. The vulnerability affects Red Hat Enterprise Linux versions 6, 7, 8, 9, and 10, as well as Red Hat OpenShift Container Platform 4, and requires local access with low privileges to exploit. No public exploit code or active exploitation has been confirmed at the time of analysis.

RemediationAI

Apply the latest security updates provided by Red Hat for affected systems; consult the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-0965 for specific patched package versions corresponding to each RHEL release and OpenShift version. Until patches can be deployed, restrict local user access to systems where SSH configuration is sensitive, enforce restrictive file permissions on SSH configuration directories to prevent unprivileged users from modifying configuration files, and consider disabling or limiting local shell access where operationally feasible. Monitor system logs for unusual SSH service behavior or access attempts to system devices that may indicate exploitation attempts.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability exists in libssh, an SSH protocol library commonly used in Red Hat Enterprise Linux distributions and containerized environments. The flaw is classified under CWE-73 (External Control of File Name or Path), which indicates improper validation of file paths during configuration parsing. When libssh processes configuration files, it fails to properly restrict which files may be opened, potentially allowing an attacker to specify paths to sensitive system resources. The affected products are identified via CPE strings spanning Red Hat Enterprise Linux 6 through 10 and Red Hat OpenShift Container Platform 4, indicating the vulnerability impacts both legacy and current supported enterprise distributions.

Know when Red Hat Enterprise Linux 10 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 3.3 LOW
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Ubuntu LOW
SUSE LOW
Red Hat 3.3 LOW

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Lifecycle Timeline

2
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
CVE Published
Mar 26, 2026 - 20:06 nvd
LOW 3.3

DescriptionCVE.org

A flaw was found in libssh where it can attempt to open arbitrary files during configuration parsing. A local attacker can exploit this by providing a malicious configuration file or when the system is misconfigured. This vulnerability could lead to a Denial of Service (DoS) by causing the system to try and access dangerous files, such as block devices or large system files, which can disrupt normal operations.

Executive ViewAI

Why It Matters

CVE-2026-0965 is a low-severity vulnerability in A flaw (CVSS 3.3). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. Apply vendor updates when available as part of routine maintenance.

Business Impact: Low
Compensating Controls

Apply vendor patch during routine maintenance. Standard security controls provide adequate interim protection.

Threat Intelligence Overview

EPSS Score
0.0%
Top 97% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity LOW
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
LOW severity (CVSS 0.1-3.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Defer
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact
Low
Technical Impact
Partial

Priority Score

16
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +16
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_enterprise_linux_10:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_6:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_enterprise_linux_9:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_openshift_container_platform_4:*:*:*:*:*:*:*:*

Related Vulnerabilities in libssh Configuration and Protocol Flaws

View all 5
CVE-2026-0966 HIGH
8.2
CVE-2026-0967 MEDIUM
5.5
CVE-2026-0968 LOW
3.1
CVE-2026-21724 MEDIUM
5.4

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-101258 HIGH POC
7.8 Oct 06

Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
CVE-2026-96889 HIGH POC
7.8 Sep 23

Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
CVE-2026-4775 HIGH POC
7.8 Mar 24

A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to

CVE-2026-114406 MEDIUM POC
6.8 Oct 21

The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-102560 CRITICAL
9.8 Sep 29

A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe

Same weakness CWE-73 – External Control of File Name or Path

View all
CVE-2024-8517 CRITICAL POC
9.8
CVE-2025-33053 HIGH POC
8.8
CVE-2023-4634 CRITICAL POC
9.8
CVE-2025-24054 MEDIUM POC
6.5
CVE-2026-96656 HIGH POC
8.6
CVE-2021-21343 HIGH POC
7.5
CVE-2025-0111 HIGH
7.1
CVE-2024-55372 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

Ubuntu

Priority: Low
libssh
Release Status Version
upstream released 0.11.4
questing released 0.11.2-1ubuntu0.2
jammy released 0.9.6-2ubuntu0.22.04.6
noble released 0.10.6-2ubuntu0.3
bionic released 0.8.0~20170825.94fa1e38-1ubuntu0.7+esm6
focal released 0.9.3-2ubuntu2.5+esm3
xenial released 0.6.3-4.3ubuntu0.6+esm4
USN-8051-1 USN-8051-2

Debian

Bug #1127693
libssh
Release Status Fixed Version Urgency
bullseye vulnerable 0.9.8-0+deb11u1 -
bullseye (security) vulnerable 0.9.8-0+deb11u2 -
bookworm vulnerable 0.10.6-0+deb12u2 -
bookworm (security) vulnerable 0.10.6-0+deb12u1 -
trixie vulnerable 0.11.2-1+deb13u1 -
forky vulnerable 0.11.3-1 -
sid fixed 0.12.0-3 -
(unstable) fixed 0.12.0-1 -

SUSE

Severity: Low
Product Status
Container private-registry/harbor-trivy-adapter:1.1.1-1.40 Container suse/manager/5.0/x86_64/server:latest Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-GCE-3P Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image pr_15_7 Affected
Container suse/ltss/sle12.5/sles12sp5:8.5.205 Image SLES12-SP5-EC2-SAP-BYOS Image SLES12-SP5-SAP-Azure-LI-BYOS-Production Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production Affected
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Affected
Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.59 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.80 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.85 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.73 Image SL-Micro-Base Image SL-Micro-Base-RT Image SL-Micro-Base-RT-SelfInstall Image SL-Micro-Base-RT-encrypted Image SL-Micro-Base-SelfInstall Image SL-Micro-Base-encrypted Image SL-Micro-Base-qcow Image SL-Micro-Default Image SL-Micro-Default-SelfInstall Image SL-Micro-Default-encrypted Image SL-Micro-Default-qcow Image SL-Micro-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected
Container suse/sle-micro-rancher/5.2:latest Container suse/sle-micro/5.2/toolbox:14.2-7.11.242 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-0965 ADVISORY https://ubuntu.com/security/notices/USN-8051-1 ADVISORY https://ubuntu.com/security/notices/USN-8051-2 ADVISORY https://vuldb.com/vuln/345439 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0567/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0778/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0779/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20524/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20531/ REF https://access.redhat.com/errata/RHSA-2026:18160 REF https://access.redhat.com/errata/RHSA-2026:18683 REF https://access.redhat.com/security/cve/CVE-2026-0965 REF https://bugzilla.redhat.com/show_bug.cgi?id=2436980

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy