Is CVE-2026-0967 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-0967 being exploited in the wild.

How severe is CVE-2026-0967?

Medium severity, with a CVSS score of 5.5, published 26 March 2026.

Which products and versions are affected?

Libssh up to 0.11.3, up to 0.12.0-rc1.

Is there a fix for CVE-2026-0967?

A patch was published on 2026-02-10: libssh versions 0.11.4 and 0.12.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-0967 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-0967?

Check whether you run Libssh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-0967: libssh ReDoS in match_pattern function

CVE-2026-0967 · Severity: medium · CVSS 5.5 · Published 2026-03-26

libssh is a widely used library that allows applications to communicate securely using the SSH protocol. A vulnerability was found where an attacker who can control a user's configuration or 'known_hosts' files can cause the application to freeze or crash. This results in a denial of service, preventing the user from establishing secure connections.

Technologies: Libssh. Vendors: Libssh.

Quick answers

Is CVE-2026-0967 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-0967 being exploited in the wild.
How severe is CVE-2026-0967?: Medium severity, with a CVSS score of 5.5, published 26 March 2026.
Which products and versions are affected?: Libssh up to 0.11.3, up to 0.12.0-rc1.
Is there a fix for CVE-2026-0967?: A patch was published on 2026-02-10: libssh versions 0.11.4 and 0.12.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-0967 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-0967?: Check whether you run Libssh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A flaw exists in the `match_pattern()` function of libssh, which is used to process conditionals in client configuration files or known_hosts files. The vulnerability is a result of inefficient regular expression backtracking (CWE-1333). An attacker who can influence these configuration files can craft specific hostnames that trigger catastrophic backtracking during pattern matching. This leads to CPU exhaustion and timeouts, resulting in a Denial of Service (DoS) for the client application. The issue is fixed in libssh versions 0.11.4 and 0.12.0.

Affected products

libssh libssh up to 0.11.3, up to 0.12.0-rc1
Red Hat Enterprise Linux 9.0
Red Hat Enterprise Linux 10.0

Timeline

2026-02-04: disclosed: Reported to Red Hat Bugzilla
2026-02-10: patched: libssh versions 0.11.4 and 0.12.0 released
2026-03-26: advisory: NVD publication date
2026-05-19: patched: Red Hat Enterprise Linux 10 security update (RHSA-2026:18160) released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.