Executive brief
A vulnerability has been identified in libssh, a library used by applications to provide secure communication over the SSH protocol. Under certain conditions, the library may attempt to process data for a communication channel that has already been closed, which can lead to application crashes or instability. This could allow an authenticated user to disrupt services or potentially gain unauthorized access to memory, impacting the reliability of systems using this library.
Technical details
A use-after-free vulnerability exists in libssh within the 'channel_rcv_data()' function in 'src/channels.c'. The flaw occurs because incoming channel DATA messages can still be processed after a channel has been marked as remotely closed. In applications using SFTP or other callback-driven mechanisms, this allows channel data callbacks to be invoked after the associated data structures have been freed. An authenticated remote attacker can exploit this to cause a denial-of-service (crash) or potentially achieve further memory corruption. The vulnerability is tracked as CVE-2026-59850 and affects various versions of libssh integrated into Red Hat Enterprise Linux.
Affected products
- libssh libssh unspecified
- Red Hat Red Hat Enterprise Linux 8 libssh package
- Red Hat Red Hat Enterprise Linux 9 libssh package
- Red Hat Red Hat Enterprise Linux 10 libssh package
Timeline
- 2026-07-08: disclosed: Initial report in Red Hat Bugzilla
- 2026-07-21: advisory: CVE published and NVD record created