Executive brief
libssh is a widely used library that allows applications to communicate securely using the SSH protocol. A vulnerability was found where an attacker who can control a user's configuration or 'known_hosts' files can cause the application to freeze or crash. This results in a denial of service, preventing the user from establishing secure connections.
Technical details
A flaw exists in the `match_pattern()` function of libssh, which is used to process conditionals in client configuration files or known_hosts files. The vulnerability is a result of inefficient regular expression backtracking (CWE-1333). An attacker who can influence these configuration files can craft specific hostnames that trigger catastrophic backtracking during pattern matching. This leads to CPU exhaustion and timeouts, resulting in a Denial of Service (DoS) for the client application. The issue is fixed in libssh versions 0.11.4 and 0.12.0.
Affected products
- libssh libssh up to 0.11.3, up to 0.12.0-rc1
- Red Hat Enterprise Linux 9.0
- Red Hat Enterprise Linux 10.0
Timeline
- 2026-02-04: disclosed: Reported to Red Hat Bugzilla
- 2026-02-10: patched: libssh versions 0.11.4 and 0.12.0 released
- 2026-03-26: advisory: NVD publication date
- 2026-05-19: patched: Red Hat Enterprise Linux 10 security update (RHSA-2026:18160) released