# CVE-2026-59843: libssh denial of service via zero maximum packet size

Source: https://junglewise.ai/threats/cve-2026-59843-libssh-denial-of-service-via-zero-maximum-packet-size  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-21. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2026-59843 · Severity: medium · CVSS 6.5 · Published 2026-07-21

A denial-of-service vulnerability has been identified in libssh, a library used by applications to provide secure communication over the SSH protocol. An authenticated user can send a specially crafted message that causes the system to enter an infinite loop, consuming all available CPU resources. This can lead to the affected service becoming unresponsive, potentially disrupting secure remote access or automated data transfers.

Technologies: [Libssh](https://junglewise.ai/threats/technologies/libssh), [Red Hat Enterprise Linux 10](https://junglewise.ai/threats/technologies/enterprise-linux-10), [Red Hat Enterprise Linux 8](https://junglewise.ai/threats/technologies/enterprise-linux-8), [Red Hat Enterprise Linux 9](https://junglewise.ai/threats/technologies/enterprise-linux-9). Vendors: [Libssh](https://junglewise.ai/threats/vendors/libssh), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-59843 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59843 being exploited in the wild.

**How severe is CVE-2026-59843?** Medium severity, with a CVSS score of 6.5, published 21 July 2026.

**Which products and versions are affected?** Libssh unspecified; Red Hat Enterprise Linux 10 affected; Red Hat Enterprise Linux 8 affected; Red Hat Enterprise Linux 9 affected.

**Is there a fix for CVE-2026-59843?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-59843 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-59843?** Check whether you run Libssh, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the channel handling logic of libssh, specifically within ssh_packet_channel_open() and ssh_packet_channel_open_conf(). The implementation fails to validate the maximum packet size advertised by a peer, allowing a value of zero to be accepted and stored in the channel state. When channel_write_common() is subsequently called, the zero value prevents the remaining data length from being decremented, resulting in an infinite loop. An authenticated attacker can trigger this by sending an SSH_MSG_CHANNEL_OPEN or SSH_MSG_CHANNEL_OPEN_CONFIRMATION message with a zero packet size, leading to uncontrolled resource consumption (CPU) and denial of service.

## Affected products

- libssh libssh unspecified
- Red Hat Red Hat Enterprise Linux 8 affected
- Red Hat Red Hat Enterprise Linux 9 affected
- Red Hat Red Hat Enterprise Linux 10 affected
- Red Hat Red Hat Hardened Images affected

## Timeline

- 2026-07-08: disclosed: Initial report in Red Hat Bugzilla
- 2026-07-21: advisory: NVD publication date

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-59843](https://access.redhat.com/security/cve/CVE-2026-59843)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2498176](https://bugzilla.redhat.com/show_bug.cgi?id=2498176)

## Related threats

- [Red Hat yggdrasil-worker-package-manager argument injection in APT backend](https://junglewise.ai/threats/cve-2026-18157-red-hat-yggdrasil-worker-package-manager-argument-injection-in)
- [Samba AD DC LDAP filter injection and ACL bypass in Compare requests](https://junglewise.ai/threats/cve-2026-58222-samba-ad-dc-ldap-filter-injection-and-acl-bypass-in-compare)
- [Samba KDC out-of-bounds read in kpasswd service](https://junglewise.ai/threats/cve-2026-58216-samba-kdc-out-of-bounds-read-in-kpasswd-service)
- [Samba internal DNS server denial of service via TKEY cache exhaustion](https://junglewise.ai/threats/cve-2026-58218-samba-internal-dns-server-denial-of-service-via-tkey-cache)
- [Red Hat PCP auth bypass in pmproxy /store endpoint](https://junglewise.ai/threats/cve-2026-16527-red-hat-pcp-auth-bypass-in-pmproxy-store-endpoint)