CVE-2026-0966

A flaw was found in libssh. The API function ssh_get_hexa() is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI (Generic Security Service Application Program Interface) authentication if the server's logging verbosity is set to SSH_LOG_PACKET (3) or higher. Successful exploitation could lead to a self-Denial of Service of the per-connection daemon process.

Attack Complexity is high as it requires the logging verbosity to be set to SSH_LOG_PACKET (3) or higher, which is not the default configuration in Red Hat Enterprise Linux.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Applications using libssh should avoid passing zero-length input to ssh_get_hexa(), ssh_get_fingerprint_hash(), and ssh_print_hexa().

For the remotely reachable GSSAPI authentication path, disable GSSAPI authentication in the affected libssh-based application if it is not required, or configure that application's libssh logging verbosity below SSH_LOG_PACKET (3). These measures address the GSSAPI logging path; they do not prevent other callers from passing zero-length input to the affected functions.

Configuration and any required restart depend on the application using libssh. Changing the host's OpenSSH sshd_config or restarting the OpenSSH sshd service is not a general mitigation for applications using libssh.

Apply the relevant vendor update containing the fix. Upstream fixed this issue in libssh 0.11.4 and 0.12.0; distribution packages may include a backported fix.