Executive brief
A flaw in the libssh library, which is used to provide secure communication for applications, could allow a local user to cause a system-wide disruption. When the library fails to start a proxy connection, it may accidentally send shutdown signals to other unrelated programs running on the same system. This can lead to a denial of service where critical applications are unexpectedly terminated.
Technical details
A vulnerability exists in libssh within the `ssh_socket_connect_proxycommand()` function in `src/socket.c`. The library fails to check the return value of the `fork()` system call; if `fork()` fails, a value of -1 is stored as the proxy child process ID (PID). During subsequent cleanup operations, the library may attempt to send signals to this PID. Because a PID of -1 in signal operations (like `kill`) targets every process the caller has permission to signal, this results in the unintended termination of the caller's accessible process tree, leading to a local denial of service. Exploitation requires the use of the `ProxyCommand` configuration and a condition where `fork()` fails (e.g., resource exhaustion).
Affected products
- libssh libssh All versions using ProxyCommand
- Red Hat Enterprise Linux 8 affected status
- Red Hat Enterprise Linux 9 affected status
- Red Hat Enterprise Linux 10 affected status
Timeline
- 2026-07-08: disclosed: Initial report in Red Hat Bugzilla
- 2026-07-21: advisory: CVE published to NVD