Skip to main content

libssh CVE-2026-59850

| EUVDEUVD-2026-46266 HIGH
Use After Free (CWE-416)
2026-07-21 redhat GHSA-cr6p-6527-344m
Denial Of Service Use After Free Memory Corruption Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Hardened Images Red Hat
7.5
CVSS 3.1 · NVD
Share

Severity by source

Vendor (redhat) PRIMARY
MEDIUM
qualitative
NVD
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

Network-reachable via the SSH protocol with attacker-controlled packet timing (AV:N/AC:L), triggered by a remote peer (PR:N), and confirmed impact is a crash so only A:H with C:N/I:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.3 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Red Hat
4.3 MEDIUM
qualitative

Primary rating from Vendor (redhat).

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Updated
Jul 30, 2026 - 16:43 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 30, 2026 - 16:37 vuln.today
cvss_changed
Severity Changed
Jul 30, 2026 - 16:37 NVD
MEDIUM HIGH
CVSS changed
Jul 30, 2026 - 16:37 NVD
4.3 (MEDIUM) 7.5 (HIGH)
Analysis Generated
Jul 21, 2026 - 15:05 vuln.today
CVE Published
Jul 21, 2026 - 14:15 cve.org
MEDIUM 4.3

DescriptionNVD

A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions.

AnalysisAI

Denial of service (and potential use-after-free) in libssh occurs when the library processes SSH data packets that arrive after a channel has been closed, causing channel data callbacks to fire against already-freed memory. Any application or system linking the affected libssh - including Red Hat Enterprise Linux 8, 9, and 10 and Red Hat Hardened Images - can be crashed by a malicious SSH peer that sends channel data at the wrong point in the connection lifecycle. There is no public exploit identified at time of analysis, EPSS is low (0.26%), and CISA SSVC scores exploitation as none, indicating a real but non-urgent memory-safety fix.

Technical ContextAI

libssh is a widely used C library implementing the SSHv2 protocol for both client and server roles; applications embed it to establish authenticated, encrypted channels over which interactive shells, subsystems, and port forwards are multiplexed. The root cause is CWE-416 (Use After Free): the channel state machine can invoke registered channel data callbacks on a buffer tied to a channel object even after that channel has been closed and its associated data freed. Because SSH multiplexes multiple channels over one transport, a late or out-of-order data packet referencing a just-closed channel reaches the dispatch path with a dangling reference. The affected CPEs point to Red Hat's redistribution of libssh across RHEL 8/9/10 and Red Hat Hardened Images rather than to the product being libssh-specific to Red Hat; the underlying defect is in the libssh codebase itself.

RemediationAI

Vendor-released patch: available per Red Hat advisory RHSA-2026:42922 - apply the updated libssh packages for your RHEL release (8, 9, or 10) via the errata at https://access.redhat.com/errata/RHSA-2026:42922 and rebuild or restart services that link libssh so the new library is loaded. Track the exact fixed NEVRA from the errata and Red Hat CVE page (https://access.redhat.com/security/cve/CVE-2026-59850); do not rely on invented version numbers. Where immediate patching is not possible, reduce exposure by restricting network reach to libssh-backed SSH listeners (firewall SSH ports to trusted management networks/bastions) and, for client-side use, avoid connecting through untrusted or attacker-controlled SSH servers - the trade-off is reduced connectivity and reliance on network segmentation rather than a code fix. Because impact is a crash/DoS, ensure affected services have supervised auto-restart to limit downtime until patched. Rebuild any bundled/vendored libssh in third-party software after updating the system library.

More in Red Hat Enterprise Linux 10

View all
CVE-2026-18663 MEDIUM
5.9 Aug 12

Heap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-18922 CRITICAL
9.8 Sep 07

Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-76578 CRITICAL
9.8 Sep 07

Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
CVE-2026-5121 HIGH
7.5 Mar 30

Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
CVE-2026-28369 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel

CVE-2026-28368 CRITICAL
9.1 Mar 27

HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
CVE-2026-33845 CRITICAL
9.1 Apr 30

Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
CVE-2026-28367 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
CVE-2026-16526 HIGH
8.8 Jul 30

Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

Share

CVE-2026-59850 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy