CVE-2026-0967

A flaw was found in libssh. A remote attacker, by controlling client configuration files or known_hosts files, could craft specific hostnames that when processed by the match_pattern() function can lead to inefficient regular expression backtracking. This can cause timeouts and resource exhaustion, resulting in a Denial of Service (DoS) for the client.

The vulnerability in libssh has been rated as Low by Red Hat Product Security.

This issue arises from inefficient pattern matching logic that may lead to excessive processing time when handling specially crafted patterns. However, these patterns originate from configuration data, meaning an attacker would need the ability to modify or influence configuration files to exploit the issue.

As a result, exploitation requires local access or equivalent local privileges, and cannot be performed remotely without prior compromise. Additionally, triggering the issue depends on specific conditions during pattern evaluation, increasing the attack complexity.

The impact of this flaw is limited to potential performance degradation or temporary delays due to increased CPU usage. It does not allow unauthorized access to data, modification of system state, or execution of arbitrary code.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Avoid using complex patterns in configuration files and known_hosts.