CVE-2026-59842 - Vulnerability Details

- Libssh: libssh: information disclosure via short gssapi curve25519 public key

Description

A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length is copied without proper length validation, leading to an out-of-bounds heap read. This could allow a remote unauthenticated attacker to disclose small amounts of server memory.

Published: 2026-07-21

Score: 3.7 Low

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a heap read caused by copying a Curve25519 public key that is shorter than expected during server-side GSSAPI key exchange in libssh. The flaw allows a remote unauthenticated attacker to read a small portion of server memory, potentially exposing sensitive data. This weakness is categorized as CWE-125, out-of-bounds read.

Affected Systems

The issue affects Red Hat Enterprise Linux 8, 9, 10 and Red Hat Hardened Images, which ship the vulnerable version of libssh. The specific product is the libssh library embedded in these operating systems.

Risk and Exploitability

The CVSS score of 3.7 indicates low severity, and the EPSS score of less than 1% suggests a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need network access to establish an SSH session and trigger the vulnerable GSSAPI key exchange; no local privileges are required.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Red Hat

Red Hat Enterprise Linux 10

affected

Version	Status	Constraints
`0:0.12.0-3.el10_2`	unaffected	< *

Red Hat

Red Hat Hardened Images

affected

Version	Status	Constraints
`0.12.1-4.hum1`	unaffected	< *

Red Hat Red Hat Enterprise Linux 8 unaffected —

Red Hat Red Hat Enterprise Linux 9 unaffected —

Configuration 1 [-]

OR	cpe:2.3:a:libssh:libssh:0.12.0:::::::*
	cpe:2.3:a:redhat:hardened_images:-:::::::*
	cpe:2.3:o:redhat:enterprise_linux:10.0:::::::*

Configuration 2 [-]

OR	cpe:2.3:o:redhat:enterprise_linux:10.0::::::arm64:
	cpe:2.3:o:redhat:enterprise_linux:10.0::::::x64:
	cpe:2.3:o:redhat:enterprise_linux:10.2::::::arm64:
	cpe:2.3:o:redhat:enterprise_linux:10.2::::::x64:
	cpe:2.3:o:redhat:enterprise_linux_for_els:10.2::::::arm64:
	cpe:2.3:o:redhat:enterprise_linux_for_els:10.2::::::x64:
	cpe:2.3:o:redhat:enterprise_linux_for_eus:10.2::::::arm64:
	cpe:2.3:o:redhat:enterprise_linux_for_eus:10.2::::::x64:
	cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:10.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:10.2:::::::*
	cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_els:10.2:::::::*
	cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:10.2:::::::*
	cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:10.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:10.2:::::::*
	cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_els:10.2:::::::*
	cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:10.2:::::::*

No data.

Vendor Product Confidence Versions

Libssh

—

Version	Status	Scheme	Platform
`—`	affected	—	—

Redhat

Enterprise Linux

100%

Version	Status	Scheme	Platform
`—`	affected	—	—

Redhat

Hardened Images

83%

Version	Status	Scheme	Platform
`—`	affected	—	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

Vendor Workaround

Disable GSSAPIKeyExchange or remove gss-curve25519-sha256- from GSSAPIKexAlgorithms if appropriate.

OpenCVE Recommended Actions

Apply the Red Hat security update RHSA‑2026:42922 that contains the libssh fix
If an immediate patch is not possible, disable GSSAPI key exchange in sshd_config by setting GSSAPIKeyExchange no
Remove gss‑curve25519‑sha256‑ from GSSAPIKexAlgorithms to prevent the vulnerable key exchange algorithm

Generated by OpenCVE AI on July 30, 2026 at 17:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00493.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://access.redhat.com/errata/RHSA-2026:42922
https://access.redhat.com/errata/RHSA-2026:55855
https://access.redhat.com/security/cve/CVE-2026-59842
https://bugzilla.redhat.com/show_bug.cgi?id=2498168
https://nvd.nist.gov/vuln/detail/CVE-2026-59842
https://www.cve.org/CVERecord?id=CVE-2026-59842

History

Tue, 22 Sep 2026 20:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Redhat enterprise Linux For Els Redhat enterprise Linux For Eus Redhat enterprise Linux For Ibm Z Systems Redhat enterprise Linux For Ibm Z Systems Els Redhat enterprise Linux For Ibm Z Systems Eus Redhat enterprise Linux For Power Little Endian Redhat enterprise Linux For Power Little Endian Els Redhat enterprise Linux For Power Little Endian Eus
CPEs	cpe:2.3:a:libssh:libssh:-:::::::*	cpe:2.3:a:libssh:libssh:0.12.0:::::::* cpe:2.3:o:redhat:enterprise_linux:10.0::::::arm64: cpe:2.3:o:redhat:enterprise_linux:10.0::::::x64: cpe:2.3:o:redhat:enterprise_linux:10.2::::::arm64: cpe:2.3:o:redhat:enterprise_linux:10.2::::::x64: cpe:2.3:o:redhat:enterprise_linux_for_els:10.2::::::arm64: cpe:2.3:o:redhat:enterprise_linux_for_els:10.2::::::x64: cpe:2.3:o:redhat:enterprise_linux_for_eus:10.2::::::arm64: cpe:2.3:o:redhat:enterprise_linux_for_eus:10.2::::::x64: cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:10.0:::::::* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:10.2:::::::* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_els:10.2:::::::* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:10.2:::::::* cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:10.0:::::::* cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:10.2:::::::* cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_els:10.2:::::::* cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:10.2:::::::*
Vendors & Products		Redhat enterprise Linux For Els Redhat enterprise Linux For Eus Redhat enterprise Linux For Ibm Z Systems Redhat enterprise Linux For Ibm Z Systems Els Redhat enterprise Linux For Ibm Z Systems Eus Redhat enterprise Linux For Power Little Endian Redhat enterprise Linux For Power Little Endian Els Redhat enterprise Linux For Power Little Endian Eus

Wed, 19 Aug 2026 05:15:00 +0000

Type	Values Removed	Values Added
CPEs	~~cpe:/o:redhat:enterprise_linux:10~~	cpe:/o:redhat:enterprise_linux:10.2
References		https://access.redhat.com/errata/RHSA-2026:55855

Mon, 27 Jul 2026 23:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Libssh Libssh libssh Redhat hardened Images
Vendors & Products		Libssh Libssh libssh Redhat hardened Images

Wed, 22 Jul 2026 20:00:00 +0000

Type	Values Removed	Values Added
References		https://access.redhat.com/errata/RHSA-2026:42922

Wed, 22 Jul 2026 14:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 22 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-59842 https://www.cve.org/CVERecord?id=CVE-2026-59842
Metrics	threat_severity `None`	threat_severity `Low`

Tue, 21 Jul 2026 11:45:00 +0000

Type	Values Removed	Values Added
Description		A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length is copied without proper length validation, leading to an out-of-bounds heap read. This could allow a remote unauthenticated attacker to disclose small amounts of server memory.
Title		Libssh: libssh: information disclosure via short gssapi curve25519 public key
First Time appeared		Redhat Redhat enterprise Linux Redhat hummingbird
Weaknesses		CWE-125
CPEs		cpe:/a:redhat:hummingbird:1 cpe:/o:redhat:enterprise_linux:10 cpe:/o:redhat:enterprise_linux:8 cpe:/o:redhat:enterprise_linux:9
Vendors & Products		Redhat Redhat enterprise Linux Redhat hummingbird
References		https://access.redhat.com/security/cve/CVE-2026-59842 https://bugzilla.redhat.com/show_bug.cgi?id=2498168
Metrics		cvssV3_1 `{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'}`

Subscriptions

Libssh Libssh

Redhat Enterprise Linux Enterprise Linux For Els Enterprise Linux For Eus Enterprise Linux For Ibm Z Systems Enterprise Linux For Ibm Z Systems Els Enterprise Linux For Ibm Z Systems Eus Enterprise Linux For Power Little Endian Enterprise Linux For Power Little Endian Els Enterprise Linux For Power Little Endian Eus Hardened Images Hummingbird

MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2026-07-21T11:08:30.540Z

Updated: 2026-08-19T04:57:33.551Z

Reserved: 2026-07-07T15:40:24.560Z

Link: CVE-2026-59842

Vulnrichment

Updated: 2026-07-22T14:01:03.020Z

NVD

Status : Analyzed

Published: 2026-07-21T12:18:57.727

Modified: 2026-09-22T19:47:55.080

Link: CVE-2026-59842

Redhat

Severity : Low

Publid Date: 2026-07-21T11:03:52Z

Links: CVE-2026-59842 - Bugzilla

OpenCVE Enrichment

Updated: 2026-07-30T18:00:15Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object