libssh EUVD-2026-46178

Three concurrent conditions are required: (1) ProxyCommand must be active in the SSH client configuration - either in the connecting user's ~/.ssh/config or in the system-wide /etc/ssh/ssh_config - this is a non-default configuration absent in most standard deployments; (2) a fork() failure must occur during ProxyCommand subprocess creation, which requires the system or per-user process count to be at or near its limit (natural exhaustion or attacker-induced via fork-bombing within their own process quota); (3) a low-privileged local account (PR:L) must actively initiate an SSH connection using the ProxyCommand path (UI:R). Exploitation is strictly bounded to local availability impact - no confidentiality or integrity compromise is possible, and the signal blast radius is limited entirely to processes that the triggering user's UID has permission to signal. Systems where ProxyCommand is never configured in any SSH client config are not affected regardless of libssh version.

The CVSS 3.1 base score of 5.3 Medium accurately reflects the constrained exploitation path: AV:L limits impact to users with local system access, AC:H reflects that ProxyCommand must be configured and a fork() failure must coincide with connection handling, PR:L requires a low-privileged account, and UI:R requires the user to actually initiate an SSH connection. The scope change (S:C) with A:H is the most notable risk factor - it means the availability impact propagates beyond libssh to all processes the attacker's user account can signal, including shells and background jobs. No EPSS score was provided in the input data; absence of a KEV listing and no identified public exploit code indicate no confirmed active exploitation at time of analysis. In practice, reliably triggering fork() failure demands either pre-existing resource exhaustion or deliberate fork-bombing by the attacker against their own process quota, making opportunistic mass exploitation unlikely. The realistic threat is a malicious or compromised local account in a multi-tenant environment using this flaw to disrupt co-tenant processes running under the same UID. No CVSS score conflict or inconsistency detected - the provided vector is well-grounded in the described mechanism.

A low-privileged local user on a multi-tenant RHEL system that has ProxyCommand configured (e.g., for jump-host access) initiates an SSH connection while the system is under process table pressure - either naturally occurring or induced by the attacker exhausting their own RLIMIT_NPROC quota. libssh's fork() call fails and returns -1, which is stored unchecked as the child PID; when the SSH session tears down and cleanup signals the 'child', Linux broadcasts the signal to all processes the attacker's UID can reach, terminating the user's own shells, background jobs, or any co-owned services.