Is CVE-2026-59850 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59850 being exploited in the wild.

How severe is CVE-2026-59850?

Medium severity, with a CVSS score of 4.3, published 21 July 2026.

Which products and versions are affected?

Libssh unspecified; Red Hat Enterprise Linux 10 libssh package; Red Hat Enterprise Linux 8 libssh package; Red Hat Enterprise Linux 9 libssh package.

Is there a fix for CVE-2026-59850?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-59850 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-59850?

Check whether you run Libssh, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59850: libssh use-after-free in channel data callbacks

CVE-2026-59850 · Severity: medium · CVSS 4.3 · Published 2026-07-21

A vulnerability has been identified in libssh, a library used by applications to provide secure communication over the SSH protocol. Under certain conditions, the library may attempt to process data for a communication channel that has already been closed, which can lead to application crashes or instability. This could allow an authenticated user to disrupt services or potentially gain unauthorized access to memory, impacting the reliability of systems using this library.

Technologies: Libssh, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9. Vendors: Libssh, Red Hat.

Quick answers

Is CVE-2026-59850 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59850 being exploited in the wild.
How severe is CVE-2026-59850?: Medium severity, with a CVSS score of 4.3, published 21 July 2026.
Which products and versions are affected?: Libssh unspecified; Red Hat Enterprise Linux 10 libssh package; Red Hat Enterprise Linux 8 libssh package; Red Hat Enterprise Linux 9 libssh package.
Is there a fix for CVE-2026-59850?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-59850 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-59850?: Check whether you run Libssh, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A use-after-free vulnerability exists in libssh within the 'channel_rcv_data()' function in 'src/channels.c'. The flaw occurs because incoming channel DATA messages can still be processed after a channel has been marked as remotely closed. In applications using SFTP or other callback-driven mechanisms, this allows channel data callbacks to be invoked after the associated data structures have been freed. An authenticated remote attacker can exploit this to cause a denial-of-service (crash) or potentially achieve further memory corruption. The vulnerability is tracked as CVE-2026-59850 and affects various versions of libssh integrated into Red Hat Enterprise Linux.

Affected products

libssh libssh unspecified
Red Hat Red Hat Enterprise Linux 8 libssh package
Red Hat Red Hat Enterprise Linux 9 libssh package
Red Hat Red Hat Enterprise Linux 10 libssh package

Timeline

2026-07-08: disclosed: Initial report in Red Hat Bugzilla
2026-07-21: advisory: CVE published and NVD record created

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.