Executive brief
libssh is a software library used by applications to communicate securely using the SSH protocol. A vulnerability exists where the library may attempt to open non-standard or excessively large files while reading its configuration settings. A local attacker could exploit this to cause a system slowdown or crash (Denial of Service) by forcing the application to access dangerous system components like block devices or pipes.
Technical details
A vulnerability classified as External Control of File Name or Path (CWE-73) exists in libssh's configuration parsing logic. The library fails to validate that configuration files (including those loaded via ssh_config_parse_file, ssh_bind_config_parse_file, or globbed includes) are regular files of a reasonable size. A local attacker with the ability to provide a malicious configuration file or exploit a system misconfiguration can force the library to open block devices, FIFOs, named pipes, or extremely large files. This can lead to a Denial of Service by exhausting system resources or hanging the process. The fix involves restricting the library to only read regular files and enforcing a 16MB size limit on configuration files.
Affected products
- libssh libssh up to (including) 0.11.3
- Red Hat Enterprise Linux 9.0
- Red Hat Enterprise Linux 10.0
Timeline
- 2026-02-04: other: Reported to Red Hat Bugzilla
- 2026-03-26: disclosed: Initial NVD publication
- 2026-05-19: patched: Red Hat released security update RHSA-2026:18160