Loading story…
Libssh released versions 0.12.1 and 0.11.5 to fix multiple security issues, including CVE-2026-59851, an authentication bypass in deployments where GSSAPIKeyExchange is enabled on servers. The flaw allows an authenticated client to log in as an arbitrary local user because the gssapi-keyex path fails to verify whether the authenticated Kerberos principal is authorized for the requested account. The vulnerability is tracked as CWE-863 and carries a CVSS v3.1 score reflecting high impact to confidentiality, integrity, and availability.
The 0.12.1 release addresses 11 CVEs, while 0.11.5 backports fixes for 8 CVEs affecting the 0.11 branch. In addition to the authentication bypass, the updates remediate a stack buffer overflow, information disclosure bugs, several denial-of-service conditions, a use-after-free issue, and an integrity downgrade flaw, alongside hardening changes such as zero-initializing ssh_string objects and validating peer public keys during Diffie-Hellman key exchange. Red Hat reported RHEL 8 and RHEL 9 as unaffected by CVE-2026-59851, listed RHEL 10 status as unknown, and marked Red Hat Hardened Images as affected for libssh and libssh2 package entries.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
On July 21, 2026, libssh announced security releases 0.12.1 and 0.11.5 to address multiple vulnerabilities and security-relevant bugs. Version 0.12.1 fixes 11 CVEs and version 0.11.5 backports fixes for 8 CVEs affecting the 0.11 branch, including an authentication bypass issue tracked as CVE-2026-59851.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple vulnerabilities in **libssh2** have exposed SSH clients and products that embed the library to attacks from malicious or impersonated SSH servers. The most severe issue, **`CVE-2026-55200`**, is a pre-authentication out-of-bounds heap write in `ssh2_transport_read()` that affects all versions through **1.11.1** and could allow remote code execution, while **`CVE-2026-55199`** can force clients into a CPU-intensive loop during key exchange and cause denial of service. The library is widely used in **curl**, backup software, IoT firmware, and network appliances, raising broad supply-chain risk, especially where libssh2 is statically linked or bundled into downstream products. A separate flaw, **`CVE-2025-15661`**, affects `sftp_symlink()` in `src/sftp.c` and can be triggered during SFTP `READLINK` or `REALPATH` operations when a malicious server or man-in-the-middle sends a crafted `SSH_FXP_NAME` response with an oversized `link_len` value. That bug causes a heap buffer over-read that may disclose memory contents or crash applications. Fixes were reported in commits **`97acf3d`**, **`1762685`**, and **`2dae302`**, but at the time of reporting no official libssh2 release containing the newer patches had been published, leaving downstream vendors responsible for shipping their own updates.
Jul 12, 2026
OpenSSH released security updates to address two vulnerabilities tracked as **CVE-2025-26465** and **CVE-2025-26466**, with downstream advisories warning that affected deployments could face both server impersonation and service disruption. According to vendor and researcher disclosures, **CVE-2025-26465** can enable a man-in-the-middle attack when `VerifyHostKeyDNS` is enabled, allowing an attacker to bypass host verification, present a crafted key, impersonate a trusted SSH server, and potentially intercept sessions, access sensitive data, or execute commands. The second issue, **CVE-2025-26466**, is a pre-authentication denial-of-service flaw caused by unbounded memory allocation triggered through `SSH2_MSG_PING` messages, which can exhaust memory and disrupt SSH availability. Guidance from OpenSSH and national CSIRT reporting urges organizations to upgrade to **OpenSSH 9.9p2 or later**, disable `VerifyHostKeyDNS` unless it is strictly required, and harden exposed services with connection controls such as `LoginGraceTime`, `MaxStartups`, and `PerSourcePenalties` to reduce exploitation risk.
Jul 24, 2026
A flaw in OpenSSH's GSSAPI key exchange handling was disclosed on the `oss-security` mailing list and later tracked as **CVE-2026-3497**, with Red Hat describing the issue as an information disclosure or denial-of-service condition caused by uninitialized variables. The bug affects OpenSSH deployments that use GSSAPI authentication or key exchange, where improper handling of internal state can allow an attacker to trigger crashes or expose unintended memory contents under certain conditions. Vendor tracking shows the issue moved from public disclosure into downstream remediation, with Red Hat opening Bugzilla case `2447085` for affected products. Separate references to Oracle Linux and a SonicWall advisory indicate vendors were also assessing or mapping related OpenSSH exposure in their own ecosystems, underscoring that the impact extends beyond a single distribution and requires organizations using GSSAPI-enabled SSH services to review patches and product advisories promptly.
Jul 12, 2026