Skip to main content

libssh EUVDEUVD-2026-16330

| CVE-2026-0966 HIGH
Buffer Underwrite ('Buffer Underflow') (CWE-124)
2026-03-26 redhat GHSA-wcqf-w94x-4wg2
High
Disputed · 8.2 NVD
Temporal: 6.5
Share

Severity by source

Sources disagree (Low–High)
NVD PRIMARY
8.2 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
CIRCL (temporal)
6.5 MEDIUM
cvss
Ubuntu
LOW
qualitative
SUSE
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Red Hat
6.5 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
High

Lifecycle Timeline

8
Analysis Updated
Apr 30, 2026 - 16:42 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Apr 30, 2026 - 16:37 vuln.today
cvss_changed
Severity Changed
Apr 30, 2026 - 16:37 NVD
MEDIUM HIGH
CVSS changed
Apr 30, 2026 - 16:37 NVD
6.5 (MEDIUM) 8.2 (HIGH)
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
EUVD ID Assigned
Mar 26, 2026 - 20:31 euvd
EUVD-2026-16330
Analysis Generated
Mar 26, 2026 - 20:31 vuln.today
CVE Published
Mar 26, 2026 - 20:06 nvd
MEDIUM 6.5

DescriptionCVE.org

The API function ssh_get_hexa() is vulnerable, when 0-lenght input is provided to this function. This function is used internally in ssh_get_fingerprint_hash() and ssh_print_hexa() (deprecated), which is vulnerable to the same input (length is provided by the calling application).

The function is also used internally in the gssapi code for logging the OIDs received by the server during GSSAPI authentication. This could be triggered remotely, when the server allows GSSAPI authentication and logging verbosity is set at least to SSH_LOG_PACKET (3). This could cause self-DoS of the per-connection daemon process.

AnalysisAI

Remote denial-of-service in libssh 0.11.x and earlier allows unauthenticated attackers to crash SSH server daemon processes via malformed GSSAPI authentication OID payloads. The vulnerability affects the ssh_get_hexa() API function when processing zero-length input, exploitable remotely when GSSAPI authentication is enabled and logging verbosity is set to SSH_LOG_PATCH (level 3) or higher. Red Hat, Ubuntu, SUSE, and Debian have released patches (libssh 0.11.4 and 0.12.0). EPSS score of 0.09% and SSVC assessment indicate low real-world exploitation likelihood despite network attack vector, with no active exploitation confirmed. Ubuntu classified this as low priority, and CISA SSVC notes exploitation as 'none' but 'automatable' with partial impact.

Technical ContextAI

libssh is a multiplatform C library implementing the SSH protocol for client and server applications. The vulnerability resides in the ssh_get_hexa() function, which performs hexadecimal string conversion. This function is called by ssh_get_fingerprint_hash(), ssh_print_hexa() (deprecated), and internally by GSSAPI authentication code for logging Object Identifiers (OIDs) received during authentication handshake. The root cause is CWE-124 (Buffer Under-read), where the function fails to properly handle zero-length input buffers. When GSSAPI authentication is enabled on the server and SSH_LOG_PACKET verbosity (level 3+) is configured, remote clients can trigger the vulnerable code path by sending crafted GSSAPI OID data during authentication negotiation. The buffer under-read causes the per-connection daemon process to crash, resulting in a denial-of-service condition for that specific SSH session. The vulnerability affects both current and legacy branches, as evidenced by patches released for libssh 0.11.4 (stable) and 0.12.0 (latest). CPE data indicates exposure across Red Hat Enterprise Linux versions 6 through 10 and Red Hat OpenShift Container Platform 4, suggesting widespread deployment in enterprise SSH infrastructure.

RemediationAI

Upgrade libssh to version 0.11.4 (stable branch) or 0.12.0 (latest branch) as documented in the official vendor security release at https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/. Enterprise Linux administrators should apply vendor-specific patches: Red Hat RHSA-2026:7067 (https://access.redhat.com/errata/RHSA-2026:7067), Ubuntu USN-8051-1 or USN-8051-2 (https://ubuntu.com/security/notices/USN-8051-1), SUSE updates per https://www.suse.com/support/update/, and Debian fixes per bug #1127693. If immediate patching is not feasible, implement compensating controls: (1) Disable GSSAPI authentication in sshd_config by setting 'GSSAPIAuthentication no' - this eliminates the remote attack vector entirely but breaks Kerberos-based SSH authentication workflows for users relying on domain credentials. (2) Reduce SSH logging verbosity below SSH_LOG_PACKET (level 3) by setting LogLevel to INFO or lower in sshd_config - this prevents the vulnerable code path from executing but sacrifices detailed packet-level audit logs needed for security monitoring and troubleshooting. Note that disabling GSSAPI is the more robust mitigation as it removes the attack surface completely, whereas reduced logging only prevents one trigger path and may still leave API-level exposure for applications calling ssh_get_hexa() directly with zero-length input.

CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h

CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft

CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-28369 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel

CVE-2026-28368 CRITICAL
9.1 Mar 27

HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls

CVE-2026-33845 CRITICAL
9.1 Apr 30

Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege

CVE-2026-28367 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator

CVE-2026-11610 HIGH
8.8 Jul 07

Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD

CVE-2026-14474 HIGH
8.8 Jul 07

Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user

CVE-2026-52720 HIGH
8.8 Jun 15

Heap buffer overflow in GStreamer's librfb (RFB/VNC client) allows a malicious VNC server to corrupt heap memory on a co

CVE-2026-5260 HIGH
8.2 May 26

Information disclosure and denial of service in GnuTLS (libgnutls) let a remote, unauthenticated attacker trigger a heap

CVE-2026-35091 HIGH
8.2 Apr 01

Out-of-bounds read in Corosync allows unauthenticated remote attackers to crash cluster nodes and potentially leak memor

Vendor StatusVendor

Ubuntu

Priority: Low
libssh
Release Status Version
upstream released 0.11.4
jammy released 0.9.6-2ubuntu0.22.04.6
noble released 0.10.6-2ubuntu0.3
questing released 0.11.2-1ubuntu0.2
bionic released 0.8.0~20170825.94fa1e38-1ubuntu0.7+esm6
focal released 0.9.3-2ubuntu2.5+esm3
xenial released 0.6.3-4.3ubuntu0.6+esm4

Debian

Bug #1127693
libssh
Release Status Fixed Version Urgency
bullseye vulnerable 0.9.8-0+deb11u1 -
bullseye (security) vulnerable 0.9.8-0+deb11u2 -
bookworm vulnerable 0.10.6-0+deb12u2 -
bookworm (security) vulnerable 0.10.6-0+deb12u1 -
trixie vulnerable 0.11.2-1+deb13u1 -
forky vulnerable 0.11.3-1 -
sid fixed 0.12.0-3 -
(unstable) fixed 0.12.0-1 -

SUSE

Severity: Medium
Product Status
Container private-registry/harbor-trivy-adapter:1.1.1-1.40 Container suse/manager/5.0/x86_64/server:latest Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-GCE-3P Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image pr_15_7 Affected
Container suse/ltss/sle12.5/sles12sp5:8.5.205 Image SLES12-SP5-EC2-SAP-BYOS Image SLES12-SP5-SAP-Azure-LI-BYOS-Production Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production Affected
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Affected
Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.59 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.80 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.85 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.73 Image SL-Micro-Base Image SL-Micro-Base-RT Image SL-Micro-Base-RT-SelfInstall Image SL-Micro-Base-RT-encrypted Image SL-Micro-Base-SelfInstall Image SL-Micro-Base-encrypted Image SL-Micro-Base-qcow Image SL-Micro-Default Image SL-Micro-Default-SelfInstall Image SL-Micro-Default-encrypted Image SL-Micro-Default-qcow Image SL-Micro-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected
Container suse/sle-micro-rancher/5.2:latest Container suse/sle-micro/5.2/toolbox:14.2-7.11.242 Affected

Share

EUVD-2026-16330 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy