Loading vulnerability…
Local denial of service in libssh ProxyCommand fork failure handling
CVE-2026-59845 is a local denial-of-service vulnerability in libssh's ProxyCommand handling. An unchecked fork() failure can cause the library to retain -1 as a child process ID. Subsequent cleanup may use this invalid identifier when sending signals, affecting processes accessible to the caller rather than only the intended ProxyCommand child process.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can disrupt or terminate processes accessible to the calling user, causing denial of service beyond the affected libssh application. The extent of disruption depends on the caller's signal permissions and process isolation. The vulnerability has a high availability impact, with no identified confidentiality or integrity impact.
If you can’t patch tonight, do this now.
Avoid or disable ProxyCommand in affected libssh-backed applications until patched. Restrict untrusted local users' ability to invoke affected clients, and run applications with least privilege and process isolation to reduce the set of processes they can signal.
Patch, then assume compromise.
Install the applicable vendor security update for libssh. Fixed package releases include 0.9.6-17.el8_10 for RHEL 8, 0.10.4-19.el9_8 for RHEL 9, and 0.12.0-3.el10_2 for RHEL 10. Ubuntu fixed libssh-4 releases are 0.9.6-2ubuntu0.22.04.8 for Ubuntu 22.04 LTS, 0.10.6-2ubuntu0.5 for Ubuntu 24.04 LTS, and 0.11.3-1ubuntu2.1 for Ubuntu 26.04 LTS. Debian trixie provides the fix in 0.11.5-0+deb13u1. Use the corresponding distribution-specific update rather than treating these package versions as universal upstream version boundaries.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
35 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.