Junglewise Threat Intelligence

CVE-2026-59849: libssh infinite loop in certificate-based authentication

CVE-2026-59849 · Severity: low · CVSS 3.1 · Published 2026-07-21

Technologies: Red Hat Enterprise Linux 10, Libssh. Vendors: Red Hat, Libssh.

Executive brief

A flaw in the libssh library, which is used to provide secure communication between computers, can cause applications to stop responding. When a client attempts to connect using certain certificate settings, a logic error can cause the software to enter an infinite loop if the certificates are missing or rejected. This results in a denial of service, preventing the user from establishing a connection.

Technical details

A vulnerability exists in the ssh_userauth_publickey_auto() function within src/auth.c of libssh. The issue stems from a logic error where the iterator over certificate candidates is not correctly advanced when certificates are missing or repeatedly rejected by the server. Under specific non-default certificate configurations, this causes the client to restart the same authentication attempts indefinitely (CWE-835). An attacker or a misconfigured server could trigger this infinite loop, resulting in a denial of service for the libssh client. The vulnerability requires a network-reachable client and specific authentication preconditions.

Affected products

  • libssh libssh unspecified
  • Red Hat Red Hat Enterprise Linux 10 affected
  • Red Hat Red Hat Hardened Images affected

Timeline

  • 2026-07-08: other: Reported to Red Hat Bugzilla
  • 2026-07-21: disclosed: CVE published to NVD

References

Related threats