EUVD-2026-16330
GHSA-wcqf-w94x-4wg2
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Lifecycle Timeline
4Description
The API function `ssh_get_hexa()` is vulnerable, when 0-lenght input is provided to this function. This function is used internally in `ssh_get_fingerprint_hash()` and `ssh_print_hexa()` (deprecated), which is vulnerable to the same input (length is provided by the calling application). The function is also used internally in the gssapi code for logging the OIDs received by the server during GSSAPI authentication. This could be triggered remotely, when the server allows GSSAPI authentication and logging verbosity is set at least to SSH_LOG_PACKET (3). This could cause self-DoS of the per-connection daemon process.
Analysis
Improper handling of zero-length input in the libssh ssh_get_hexa() function enables remote denial of service against SSH daemons with GSSAPI authentication enabled and packet-level logging active (SSH_LOG_PACKET or higher verbosity). Unauthenticated remote attackers can trigger a per-connection daemon process crash by sending specially crafted GSSAPI authentication packets containing malformed OID data, affecting Red Hat Enterprise Linux versions 6 through 10 and OpenShift Container Platform 4. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.
Sign in for detailed remediation steps.
Priority Score
Vendor Status
Ubuntu
Priority: Low| Release | Status | Version |
|---|---|---|
| upstream | released | 0.11.4 |
| jammy | released | 0.9.6-2ubuntu0.22.04.6 |
| noble | released | 0.10.6-2ubuntu0.3 |
| questing | released | 0.11.2-1ubuntu0.2 |
| bionic | released | 0.8.0~20170825.94fa1e38-1ubuntu0.7+esm6 |
| focal | released | 0.9.3-2ubuntu2.5+esm3 |
| xenial | released | 0.6.3-4.3ubuntu0.6+esm4 |
Debian
Bug #1127693| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | vulnerable | 0.9.8-0+deb11u1 | - |
| bullseye (security) | vulnerable | 0.9.8-0+deb11u2 | - |
| bookworm | vulnerable | 0.10.6-0+deb12u2 | - |
| bookworm (security) | vulnerable | 0.10.6-0+deb12u1 | - |
| trixie | vulnerable | 0.11.2-1+deb13u1 | - |
| forky | vulnerable | 0.11.3-1 | - |
| sid | fixed | 0.12.0-3 | - |
| (unstable) | fixed | 0.12.0-1 | - |
Share
External POC / Exploit Code
Leaving vuln.today