EUVD-2026-46263
GHSA-jp6g-7mqj-wj53
Severity by source
Sources disagree (Low–High)AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Client must be configured for certificate auth and must connect to a hostile/misconfigured server, so AC:H and UI:R; impact is availability-only (A:H) with no confidentiality or integrity effect.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
6DescriptionNVD
A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when configured certificates are missing or repeatedly rejected by a server, leading to denial of service.
AnalysisAI
Denial of service in libssh affects clients that use automatic certificate-based public key authentication, where logic errors cause the client to loop indefinitely when configured certificates are absent or are repeatedly rejected by the SSH server. Reported by Red Hat and shipped in Red Hat Enterprise Linux 8, 9, and 10 plus Red Hat Hardened Images, the flaw lets a hostile or misconfigured server hang a connecting client and consume CPU. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a libssh client configured for automatic certificate-based public key authentication, plus either the configured certificates being missing or a server that repeatedly rejects the client's certificate during authentication. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) scores this high due to a pure availability impact with no confidentiality or integrity loss. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker operates or compromises an SSH server and lures or waits for a libssh-based client configured with automatic certificate-based public key authentication to connect. The server repeatedly rejects the client's offered certificate (or the client has no valid certificate configured), driving the client into an infinite authentication loop that hangs the process and consumes CPU. … |
| Remediation | Patch available per vendor advisory: apply the libssh update delivered in Red Hat errata RHSA-2026:42922 (https://access.redhat.com/errata/RHSA-2026:42922) for the affected RHEL 8, 9, and 10 streams and Red Hat Hardened Images, then restart or rebuild any services and containers that link libssh so the fixed library is loaded. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Red Hat Enterprise Linux 8, 9, and 10 systems using libssh with automatic certificate-based authentication, and document which systems initiate outbound SSH connections. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Enterprise Linux 10
View allRemote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD
Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user
Heap buffer overflow in GStreamer's librfb (RFB/VNC client) allows a malicious VNC server to corrupt heap memory on a co
Privilege escalation via authentication bypass in libssh affects servers that enable GSSAPIKeyExchange, where the gssapi
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today