CVE-2026-59847
libssh: libssh: integrity downgrade via OpenSSL AES-GCM tag verification
Loading…
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · July 21, 2026
Updated · September 2, 2026
Description
A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
Disable the [email protected] and [email protected] ciphers.
CVSS / CWE
CVSS 3.1 · 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-253 · Incorrect Check of Function Return Value