Skip to main content

libssh CVE-2026-59847

| EUVDEUVD-2026-46255 HIGH
Missing Ability to Patch ROM Code (CWE-1310)
2026-07-21 redhat GHSA-mq2j-7vq4-77m8
Information Disclosure OpenSSL Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Hardened Images Red Hat
7.5
CVSS 3.1 · NVD
Share

Severity by source

Vendor (redhat) PRIMARY
MEDIUM
qualitative
NVD
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
vuln.today AI
5.9 MEDIUM

Exploitation demands a persistent in-path MITM position (AC:H) and no authentication (PR:N); impact is undetected data tampering only, so I:H with C:N and A:N.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
6.5 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L
Red Hat
5.9 MEDIUM
qualitative

Primary rating from Vendor (redhat).

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

6
Analysis Updated
Jul 30, 2026 - 13:29 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 30, 2026 - 13:22 vuln.today
cvss_changed
Severity Changed
Jul 30, 2026 - 13:22 NVD
MEDIUM HIGH
CVSS changed
Jul 30, 2026 - 13:22 NVD
5.9 (MEDIUM) 7.5 (HIGH)
Analysis Generated
Jul 21, 2026 - 14:31 vuln.today
CVE Published
Jul 21, 2026 - 13:18 nvd
MEDIUM 5.9

DescriptionNVD

A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection.

AnalysisAI

Integrity-protection bypass in libssh builds compiled against the OpenSSL crypto backend, caused by incorrect AES-GCM finalization checks that fail to verify the authentication tag. An in-path (man-in-the-middle) attacker positioned on an SSH session can silently alter plaintext bytes on the wire without triggering a MAC/integrity failure, defeating a core guarantee of the SSH transport layer. There is no public exploit identified at time of analysis, EPSS risk is low (0.28%, 20th percentile), and CISA SSVC rates exploitation as 'none' though 'automatable: yes'.

Technical ContextAI

libssh is a widely used C implementation of the SSHv2 protocol used by applications to embed SSH client/server functionality (distinct from OpenSSH). When built with the OpenSSL backend, it delegates AEAD cipher operations - here AES-GCM (aes128-gcm@openssh.com / aes256-gcm@openssh.com) - to OpenSSL's EVP interface. AES-GCM provides both confidentiality and an integrity tag; the receiver must call the finalization/verification step and reject the packet if the computed tag does not match. The flaw is that this GCM finalization check is performed incorrectly, so a tampered ciphertext is accepted as authentic. The root cause is an improper integrity-check-verification class of bug (conceptually CWE-354, Improper Validation of Integrity Check Value); note the supplied CWE-1310 ('Missing Ability to Patch ROM Code') does not fit this software integrity flaw and appears to be a data-quality mismatch in the source feed. Affected components per Red Hat CPE data are the libssh packages shipped in Red Hat Enterprise Linux 8, 9, and 10 and Red Hat Hardened Images.

RemediationAI

Patch available per vendor advisory: apply the updated libssh packages from Red Hat errata RHSA-2026:42922 (https://access.redhat.com/errata/RHSA-2026:42922) across RHEL 8, 9, 10, and rebuild or re-pull Red Hat Hardened Images so they include the fixed library; exact fixed version strings should be taken from that errata as they are not included in this dataset. After updating, restart or redeploy all services that link libssh so the corrected code is loaded. If immediate patching is not possible, a targeted compensating control is to negotiate away the affected AES-GCM ciphers and prefer an EtM (encrypt-then-MAC) cipher/MAC combination in the SSH configuration so integrity does not rely on the broken GCM finalization - the trade-off is reduced performance and possible interoperability issues with peers that only offer GCM. Additionally, constrain SSH traffic to trusted network paths / VPN tunnels and enforce strict host-key verification to raise the bar for the required in-path position. Also review the oss-security advisory (https://seclists.org/oss-sec/2026/q3/197) and VulDB entry (https://vuldb.com/vuln/380899) for upstream fix details.

More in OpenSSL

View all
CVE-2014-0160 HIGH POC
7.5 Apr 07

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
CVE-2014-0195 MEDIUM POC
6.8 Jun 05

The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2016-0800 MEDIUM POC
5.9 Mar 01

The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to se
CVE-2015-0204 MEDIUM POC
4.3 Jan 09

The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k

CVE-2015-4000 LOW POC
3.7 May 21

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not pro
CVE-2014-3566 LOW POC
3.4 Oct 15

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
CVE-2016-2107 MEDIUM POC
5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

CVE-2015-1793 MEDIUM POC
6.5 Jul 09

The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly

CVE-2022-3602 HIGH
7.5 Nov 01

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig
CVE-2014-3470 MEDIUM
4.3 Jun 05

The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before
CVE-2017-3730 HIGH POC
7.5 May 04

In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this

Same weakness CWE-1310 – Missing Ability to Patch ROM Code

View all
CVE-2026-85544 MEDIUM
5.2

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

Share

CVE-2026-59847 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy