Loading vulnerability…
Heap out-of-bounds read in libssh GSSAPI Curve25519 key exchange
CVE-2026-59842 is an out-of-bounds heap read in libssh's server-side GSSAPI key exchange. A client-supplied Curve25519 public key shorter than the expected length is copied without sufficient length validation, causing a read beyond the supplied heap buffer. A remote unauthenticated attacker may exploit this flaw to disclose small amounts of server memory.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation may expose small amounts of server memory to a remote unauthenticated attacker. The specific data exposed and the reliability or extent of disclosure are not established. Supported F5 releases evaluated for this vulnerability are unaffected; that assessment excludes releases beyond End of Technical Support.
If you can’t patch tonight, do this now.
Where an immediate upgrade is not possible, disable server-side GSSAPI key exchange to prevent exploitation through the affected key-exchange path. Restrict SSH service exposure to trusted networks until fixed packages can be deployed.
Patch, then assume compromise.
Upgrade affected libssh deployments to version 0.12.1 or an applicable vendor-fixed release. For Red Hat Enterprise Linux 10, apply RHSA-2026:55855, which supplies the fixed libssh package release 0.12.0-3.el10_2. No remediation is required for the supported F5 releases evaluated as unaffected.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.