DoS in Libssh: Zero Max Packet Size Loop in SSH_MSG_CHANNEL_OPEN
CVE-2026-59843 Published on July 21, 2026
Libssh: libssh: denial of service via zero advertised channel packet size
A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later channel writes to loop indefinitely and consume CPU, leading to denial of service.
Vulnerability Analysis
CVE-2026-59843 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.
Timeline
Reported to Red Hat.
Made public. 83 days later.
Weakness Types
What is an Infinite Loop Vulnerability?
The program contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. If the loop can be influenced by an attacker, this weakness could allow attackers to consume excessive resources such as CPU or memory.
CVE-2026-59843 has been classified to as an Infinite Loop vulnerability or weakness.
What is a Resource Exhaustion Vulnerability?
The software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVE-2026-59843 has been classified to as a Resource Exhaustion vulnerability or weakness.
Products Associated with CVE-2026-59843
stack.watch emails you whenever new vulnerabilities are published in Red Hat Enterprise Linux (RHEL) or Red Hat Hummingbird. Just hit a watch button to start following.
Affected Versions
Red Hat Enterprise Linux 10:- Version 0:0.12.0-3.el10_2 and below * is unaffected.
- Version 0.12.1-4.hum1 and below * is unaffected.