Executive brief
A flaw in the libssh library, which is used to provide secure communication between computers, can cause applications to stop responding. When a client attempts to connect using certain certificate settings, a logic error can cause the software to enter an infinite loop if the certificates are missing or rejected. This results in a denial of service, preventing the user from establishing a connection.
Technical details
A vulnerability exists in the ssh_userauth_publickey_auto() function within src/auth.c of libssh. The issue stems from a logic error where the iterator over certificate candidates is not correctly advanced when certificates are missing or repeatedly rejected by the server. Under specific non-default certificate configurations, this causes the client to restart the same authentication attempts indefinitely (CWE-835). An attacker or a misconfigured server could trigger this infinite loop, resulting in a denial of service for the libssh client. The vulnerability requires a network-reachable client and specific authentication preconditions.
Affected products
- libssh libssh unspecified
- Red Hat Red Hat Enterprise Linux 10 affected
- Red Hat Red Hat Hardened Images affected
Timeline
- 2026-07-08: other: Reported to Red Hat Bugzilla
- 2026-07-21: disclosed: CVE published to NVD