Loading vulnerability…
libssh denial of service via zero advertised channel packet size
CVE-2026-59843 is an infinite-loop vulnerability in libssh's handling of SSH channel-open messages. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN. Subsequent writes to that channel loop indefinitely and consume CPU, causing denial of service in affected libssh client or server applications.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation can cause sustained CPU consumption and loss of availability in applications using vulnerable libssh channel-writing functionality. The vulnerability has a CVSS v3 base score of 6.5, with high availability impact and no identified confidentiality or integrity impact.
If you can’t patch tonight, do this now.
Until patched, restrict SSH access to trusted peers and users, including authenticated access to services implemented with libssh. Access restrictions reduce exposure but do not correct the channel-handling flaw.
Patch, then assume compromise.
Install the applicable vendor-fixed libssh packages. Fixed releases include Ubuntu 26.04 LTS 0.11.3-1ubuntu2.1, Ubuntu 24.04 LTS 0.10.6-2ubuntu0.5, Ubuntu 22.04 LTS 0.9.6-2ubuntu0.22.04.8, Debian trixie 0.11.5-0+deb13u1, RHEL 10 0.12.0-3.el10_2, RHEL 9 0.10.4-19.el9_8, and RHEL 8 0.9.6-17.el8_10. Echo deployments should update libssh and related packages to 0.12.2-1 or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
36 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.