Loading vulnerability…
Use-after-free in libssh post-close channel data callbacks
CVE-2026-59850 is a channel-lifecycle vulnerability in libssh. When data packets are processed after an SSH channel has closed, libssh can invoke channel data callbacks after their associated data has been freed. This can cause crashes or use-after-free memory corruption, with potential arbitrary code execution in affected applications. The flaw also affects the SSH Proxy feature of BIG-IP AFM.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Affected libssh applications can crash, causing denial of service. Use-after-free memory corruption may potentially permit arbitrary code execution, although successful code execution is not established. In BIG-IP AFM configurations using SSH Proxy, exploitation can terminate an sshplugin worker process and drop every SSH session handled by that worker; other workers remain operational. Repeated exploitation could disrupt SSH service.
If you can’t patch tonight, do this now.
Pending patching, restrict untrusted network access to applications using affected libssh versions to reduce exposure. No vulnerability-specific workaround is documented, and F5 lists no mitigation for the affected BIG-IP AFM SSH Proxy configuration.
Patch, then assume compromise.
Install the vendor security update for the affected libssh packages. Fixed Ubuntu libssh-4 versions are 0.11.3-1ubuntu2.1 for Ubuntu 26.04 LTS, 0.10.6-2ubuntu0.5 for Ubuntu 24.04 LTS, and 0.9.6-2ubuntu0.22.04.8 for Ubuntu 22.04 LTS. Debian 13 (trixie) provides version 0.11.5-0+deb13u1. Other distributions should apply their corresponding libssh security updates. For BIG-IP AFM, no fixed release was listed as of October 22, 2026; install an F5-fixed release when available.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
37 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.