Executive brief
A denial-of-service vulnerability has been identified in libssh, a library used by applications to provide secure communication over the SSH protocol. An authenticated user can send a specially crafted message that causes the system to enter an infinite loop, consuming all available CPU resources. This can lead to the affected service becoming unresponsive, potentially disrupting secure remote access or automated data transfers.
Technical details
A vulnerability exists in the channel handling logic of libssh, specifically within ssh_packet_channel_open() and ssh_packet_channel_open_conf(). The implementation fails to validate the maximum packet size advertised by a peer, allowing a value of zero to be accepted and stored in the channel state. When channel_write_common() is subsequently called, the zero value prevents the remaining data length from being decremented, resulting in an infinite loop. An authenticated attacker can trigger this by sending an SSH_MSG_CHANNEL_OPEN or SSH_MSG_CHANNEL_OPEN_CONFIRMATION message with a zero packet size, leading to uncontrolled resource consumption (CPU) and denial of service.
Affected products
- libssh libssh unspecified
- Red Hat Red Hat Enterprise Linux 8 affected
- Red Hat Red Hat Enterprise Linux 9 affected
- Red Hat Red Hat Enterprise Linux 10 affected
- Red Hat Red Hat Hardened Images affected
Timeline
- 2026-07-08: disclosed: Initial report in Red Hat Bugzilla
- 2026-07-21: advisory: NVD publication date