Yüksek CVSS 8.2
CVE-2026-0966: Libssh: güvenlik açığı
Açıklama (NVD)
A flaw was found in libssh. The API function `ssh_get_hexa()` is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI (Generic Security Service Application Program Interface) authentication if the server's logging verbosity is set to `SSH_LOG_PACKET (3)` or higher. Successful exploitation could lead to a self-Denial of Service of the per-connection daemon process.
Özet bilgiler
- Ürün
- Libssh Libssh
- CVSS v3.1
- 8.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - EPSS
- %0,60 (yüzdelik 49)
- CWE
- CWE-124
- Yama
- Geçici çözüm
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| libssh-libssh | — | — | 0.11.4 |
| redhat-hardened-images | — | — | — |
| redhat-openshift-container-platform | 4.0 | 4.0 | — |
| redhat-enterprise-linux | 8.0 | 8.0 | — |
| redhat-enterprise-linux | 9.0 | 9.0 | — |
| redhat-enterprise-linux | 10.0 | 10.0 | — |