CVE-2026-59850

libssh: libssh: use-after-free via data callbacks on closed channels

Loading…

Severity

Moderate

Red Hat Product Security

4.3

CVSS 3.1

Review impact separately from score.

Published · July 21, 2026

Updated · September 2, 2026

Description

A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

Manually verify the channel is not closed inside your channel data callbacks.

CVSS / CWE

CVSS 3.1 · 4.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CWE-416 · Use After Free