A flaw in libssh triggers when a ProxyCommand is used. An unchecked fork() failure can result in storing a process ID of -1, which is then referenced during cleanup. Signals may be sent to the caller’s accessible process tree, causing the libssh client to crash and resulting in a local denial of service. The weakness is improper handling of fork return values (CWE‑390).

This vulnerability affects Red Hat Enterprise Linux 8, 9, and 10, as well as Red Hat Hardened Images that include libssh. The packages that ship libssh with the default configuration are impacted. No specific version ranges beyond the distribution releases are provided in the advisory.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% signals a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local access to a system that runs libssh with the ProxyCommand feature enabled; an attacker who can execute commands locally can trigger the fault, causing the client process to crash and denying service to the user.