low3.7
CVE-2026-59842
A flaw was found in libssh.
Impact
A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length is copied without proper length validation, leading to an out-of-bounds heap read. This could allow a remote unauthenticated attacker to disclose small amounts of server memory.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Libssh | Libssh | Version 0.12.0 |
| Redhat | Hardened Images | All versions |
| Redhat | Enterprise Linux | Versions 10.0, 10.2 |
| Redhat | Enterprise Linux For Els | Version 10.2 |
| Redhat | Enterprise Linux For Eus | Version 10.2 |
| Redhat | Enterprise Linux For Ibm Z Systems | Versions 10.0, 10.2 |
| Redhat | Enterprise Linux For Ibm Z Systems Els | Version 10.2 |
| Redhat | Enterprise Linux For Ibm Z Systems Eus | Version 10.2 |
| Redhat | Enterprise Linux For Power Little Endian | Versions 10.0, 10.2 |
| Redhat | Enterprise Linux For Power Little Endian Els | Version 10.2 |
| Redhat | Enterprise Linux For Power Little Endian Eus | Version 10.2 |