Is CVE-2026-0966 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-0966 being exploited in the wild.

How severe is CVE-2026-0966?

High severity, with a CVSS score of 8.2, published 26 March 2026.

Which products and versions are affected?

Libssh up to (excluding) 0.11.4, up to (excluding) 0.12.0, versions up to (excluding) 0.11.4.

Is there a fix for CVE-2026-0966?

A patch was published on 2026-02-10: libssh versions 0.12.0 and 0.11.4 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-0966 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-0966?

Check whether you run Libssh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-0966: libssh denial of service in ssh_get_hexa function

CVE-2026-0966 · Severity: high · CVSS 8.2 · Published 2026-03-26

A vulnerability has been identified in libssh, a library used by many applications to implement secure communications. An attacker can remotely crash the specific process handling their connection by sending specially crafted data during the authentication phase. This occurs only if the server has high-level debug logging enabled, potentially leading to a denial of service for that specific user session.

Technologies: Libssh. Vendors: Libssh.

Quick answers

Is CVE-2026-0966 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-0966 being exploited in the wild.
How severe is CVE-2026-0966?: High severity, with a CVSS score of 8.2, published 26 March 2026.
Which products and versions are affected?: Libssh up to (excluding) 0.11.4, up to (excluding) 0.12.0, versions up to (excluding) 0.11.4.
Is there a fix for CVE-2026-0966?: A patch was published on 2026-02-10: libssh versions 0.12.0 and 0.11.4 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-0966 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-0966?: Check whether you run Libssh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A buffer underflow vulnerability (CWE-124) exists in the libssh API function `ssh_get_hexa()` when it receives zero-length input. This function is utilized internally by `ssh_get_fingerprint_hash()` and within the GSSAPI code for logging Object Identifiers (OIDs) received by the server. An unauthenticated remote attacker can trigger this flaw during GSSAPI authentication if the server's logging verbosity is set to `SSH_LOG_PACKET (3)` or higher. Successful exploitation results in a denial of service (DoS) of the per-connection daemon process. The issue is fixed in libssh versions 0.11.4 and 0.12.0.

Affected products

libssh libssh up to (excluding) 0.11.4, up to (excluding) 0.12.0
Red Hat Enterprise Linux 8.0, 9.0, 10.0
Red Hat OpenShift Container Platform 4.0

Timeline

2026-01-26: other: Reported to Red Hat Bugzilla
2026-02-10: patched: libssh versions 0.12.0 and 0.11.4 released
2026-03-26: disclosed: CVE published
2026-05-19: advisory: Red Hat security advisory RHSA-2026:18160 issued

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.