libssh EUVD-2026-46177

Exploitation requires the attacker to hold a valid, authenticated SSH session against a service built on libssh - corresponding to the PR:L metric in the CVSS vector. The trigger is a crafted SSH_MSG_CHANNEL_OPEN message with a zero maximum packet size, which is a standard protocol message available to any authenticated channel opener; no special feature flag, non-default configuration, or elevated permission beyond basic authentication is required. Exploitation is limited by the authentication requirement: unauthenticated network actors cannot reach the vulnerable code path. The impact is confined to CPU exhaustion on the target process (S:U, scope unchanged) - there is no confidentiality or integrity impact. Platform scope is constrained to deployments of the libssh library on Red Hat Enterprise Linux 8, 9, 10, and Hardened Images per available CPE data.

CVSS 3.1 scores this at 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The network vector and low attack complexity indicate this is remotely triggerable with minimal effort, but PR:L confirms that a valid authenticated session is a hard prerequisite - unauthenticated attackers cannot reach the vulnerable code path. The availability impact is High, meaning a single malicious authenticated peer can fully saturate the CPU of the target process. No KEV listing is present in the input data, meaning confirmed active exploitation has not been reported to CISA. No public POC is identified. No EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified here. The realistic threat actor is an insider or a user with compromised SSH credentials; opportunistic mass exploitation is constrained by the authentication barrier. The signals are internally consistent - CVSS vector aligns with the described attack mechanism - and no conflicting data is present.

An attacker with valid SSH credentials connects to a server running a libssh-based SSH daemon and initiates channel negotiation by sending SSH_MSG_CHANNEL_OPEN with the maximum packet size field set to zero. The libssh server-side write loop, lacking a guard against a zero-size limit, enters an infinite iteration and pegs CPU utilization, effectively causing denial of service for the duration of the connection. No public POC has been identified, but the attack requires only standard SSH protocol messages and low-level protocol knowledge.