Skip to main content

libssh CVE-2026-59850

| EUVDEUVD-2026-46266 HIGH
Use After Free (CWE-416)
2026-07-21 redhat GHSA-cr6p-6527-344m
Use After Free Denial Of Service Memory Corruption Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Hardened Images
7.5
CVSS 3.1 · NVD
Share

Severity by source

Vendor (redhat) PRIMARY
MEDIUM
qualitative
NVD
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

Network-reachable via the SSH protocol with attacker-controlled packet timing (AV:N/AC:L), triggered by a remote peer (PR:N), and confirmed impact is a crash so only A:H with C:N/I:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.3 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Red Hat
4.3 MEDIUM
qualitative

Primary rating from Vendor (redhat).

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Updated
Jul 30, 2026 - 16:43 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 30, 2026 - 16:37 vuln.today
cvss_changed
Severity Changed
Jul 30, 2026 - 16:37 NVD
MEDIUM HIGH
CVSS changed
Jul 30, 2026 - 16:37 NVD
4.3 (MEDIUM) 7.5 (HIGH)
Analysis Generated
Jul 21, 2026 - 15:05 vuln.today
CVE Published
Jul 21, 2026 - 14:15 cve.org
MEDIUM 4.3

DescriptionNVD

A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions.

AnalysisAI

Denial of service (and potential use-after-free) in libssh occurs when the library processes SSH data packets that arrive after a channel has been closed, causing channel data callbacks to fire against already-freed memory. Any application or system linking the affected libssh - including Red Hat Enterprise Linux 8, 9, and 10 and Red Hat Hardened Images - can be crashed by a malicious SSH peer that sends channel data at the wrong point in the connection lifecycle. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Establish SSH connection to libssh peer
Delivery
Open then close a channel
Exploit
Send channel data after close
Execution
Trigger callback on freed memory
Impact
Crash service (possible use-after-free)
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The specific prerequisite from the description is a channel-lifecycle race: the attacker (the remote SSH peer) must cause data packets to be processed for a channel after that channel has already been closed, so that a channel data callback fires against freed data. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment Signals are consistent and point to a moderate, availability-only issue rather than a top-tier priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A malicious SSH peer (a rogue server against a libssh client, or a connecting client against a libssh server) opens a channel and then arranges to send channel data packets immediately after the channel is closed. The library dispatches the data callback against freed memory, crashing the SSH process and denying service; in principle the use-after-free could be steered toward memory corruption, though no public exploit demonstrating code execution has been identified.
Remediation Vendor-released patch: available per Red Hat advisory RHSA-2026:42922 - apply the updated libssh packages for your RHEL release (8, 9, or 10) via the errata at https://access.redhat.com/errata/RHSA-2026:42922 and rebuild or restart services that link libssh so the new library is loaded. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all systems running RHEL 8, 9, or 10 with libssh installed and create a patch schedule prioritizing production systems; establish a maintenance window for patching. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Red Hat Enterprise Linux 10

View all
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-28369 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel

CVE-2026-28368 CRITICAL
9.1 Mar 27

HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
CVE-2026-33845 CRITICAL
9.1 Apr 30

Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
CVE-2026-28367 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
CVE-2026-16526 HIGH
8.8 Jul 30

Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
CVE-2026-11610 HIGH
8.8 Jul 07

Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD
CVE-2026-14474 HIGH
8.8 Jul 07

Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user

CVE-2026-52720 HIGH
8.8 Jun 15

Heap buffer overflow in GStreamer's librfb (RFB/VNC client) allows a malicious VNC server to corrupt heap memory on a co
CVE-2026-59851 HIGH
8.8 Jul 21

Privilege escalation via authentication bypass in libssh affects servers that enable GSSAPIKeyExchange, where the gssapi

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Use After Free

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8
CVE-2012-4969 HIGH POC
8.1

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

Share

CVE-2026-59850 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy