CVE-2026-59849

libssh: libssh: denial of service via automatic certificate authentication loop

Loading…

Severity

Low

Red Hat Product Security

3.1

CVSS 3.1

Review impact separately from score.

Published · July 21, 2026

Updated · August 19, 2026

Description

A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when configured certificates are missing or repeatedly rejected by a server, leading to denial of service.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

Do not connect to untrusted SSH servers and do not use certificates until patched.

CVSS / CWE

CVSS 3.1 · 3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

CWE-835 · Loop with Unreachable Exit Condition ('Infinite Loop')