A zero‑length input supplied to the libssh function ssh_get_hexa() triggers a buffer underflow. The function is utilized by ssh_get_fingerprint_hash() and the deprecated ssh_print_hexa(), and is also employed in GSSAPI authentication logging. This unvalidated input can cause the per‑connection SSH daemon to crash or become unresponsive, resulting in a denial of service. The weakness is a classic buffer underflow (CWE‑124) and has no direct impact on confidentiality or integrity.

The vulnerability affects Red Hat Enterprise Linux releases 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. The affected component is the libssh library, particularly versions used in the sshd server on these platforms. Exact libssh version numbers are not specified in the data, but the issue applies to the bundles shipped with the indicated operating systems and container platform.

The CVSS score of 6.5 indicates moderate impact, and the EPSS score of less than 1% suggests a very low likelihood of exploitation at present. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Remote exploitation requires that the SSH server allow GSSAPI authentication and that logging level is configured to SSH_LOG_PACKET (the numeric value 3) or higher. An attacker who satisfies those prerequisites can trigger the denial of service by initiating a GSSAPI authentication attempt. Because the effect is self‑DoS rather than privilege escalation or data exfiltration, the overall risk is limited to availability degradation, although a high volume of triggered events could contribute to a larger denial‑of‑service scenario.