RHSA-2026:7067

Vulnerability from csaf_redhat - Published: 2026-04-08 13:23 - Updated: 2026-04-30 16:37
Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Severity
Moderate
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs:
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2025-14821

A flaw was found in libssh. This vulnerability allows local man-in-the-middle attacks, security downgrades of SSH (Secure Shell) connections, and manipulation of trusted host information, posing a significant risk to the confidentiality, integrity, and availability of SSH communications via an insecure default configuration on Windows systems where the library automatically loads configuration files from the C:\etc directory, which can be created and modified by unprivileged local users.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-427 - Uncontrolled Search Path Element
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:7067
Workaround Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
CVE-2026-0966

The API function `ssh_get_hexa()` is vulnerable, when 0-lenght input is provided to this function. This function is used internally in `ssh_get_fingerprint_hash()` and `ssh_print_hexa()` (deprecated), which is vulnerable to the same input (length is provided by the calling application). The function is also used internally in the gssapi code for logging the OIDs received by the server during GSSAPI authentication. This could be triggered remotely, when the server allows GSSAPI authentication and logging verbosity is set at least to SSH_LOG_PACKET (3). This could cause self-DoS of the per-connection daemon process.

6.5 (Medium)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CWE-124 - Buffer Underwrite ('Buffer Underflow')
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:7067
Workaround To mitigate this issue, consider disabling GSSAPI authentication if it is not required, or reduce the `LogLevel` in the `sshd_config` file to a value lower than `SSH_LOG_PACKET` (e.g., `INFO`). To disable GSSAPI authentication, add or modify the following line in `/etc/ssh/sshd_config`: `GSSAPIAuthentication no` To reduce logging verbosity, add or modify the following line in `/etc/ssh/sshd_config`: `LogLevel INFO` After making changes to `sshd_config`, the `sshd` service must be restarted for the changes to take effect. This may temporarily interrupt active SSH sessions.
CVE-2026-3731

A flaw was found in libssh. A remote attacker could trigger an out-of-bounds read vulnerability in the SFTP Extension Name Handler by manipulating the `idx` argument in the `sftp_extensions_get_name` or `sftp_extensions_get_data` functions. This could lead to a Denial of Service (DoS), making the affected system unresponsive.

5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-125 - Out-of-bounds Read
Vendor Fix For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:7067
Workaround Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
References
Acknowledgments
Martin Grubhofer
Kang Yang Yunhang Zhang Jun Xu
libssh Jakub Jelen
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:7067",
        "url": "https://access.redhat.com/errata/RHSA-2026:7067"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-3731",
        "url": "https://access.redhat.com/security/cve/CVE-2026-3731"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-0966",
        "url": "https://access.redhat.com/security/cve/CVE-2026-0966"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-14821",
        "url": "https://access.redhat.com/security/cve/CVE-2025-14821"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7067.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-04-30T16:37:23+00:00",
      "generator": {
        "date": "2026-04-30T16:37:23+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.7"
        }
      },
      "id": "RHSA-2026:7067",
      "initial_release_date": "2026-04-08T13:23:35+00:00",
      "revision_history": [
        {
          "date": "2026-04-08T13:23:35+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-04-24T23:24:37+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-04-30T16:37:23+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libssh-main@aarch64",
                "product": {
                  "name": "libssh-main@aarch64",
                  "product_id": "libssh-main@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libssh@0.12.0-1.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libssh-main@src",
                "product": {
                  "name": "libssh-main@src",
                  "product_id": "libssh-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libssh@0.12.0-1.1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libssh-main@x86_64",
                "product": {
                  "name": "libssh-main@x86_64",
                  "product_id": "libssh-main@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libssh@0.12.0-1.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libssh-main@noarch",
                "product": {
                  "name": "libssh-main@noarch",
                  "product_id": "libssh-main@noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libssh-config@0.12.0-1.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libssh-main@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:libssh-main@aarch64"
        },
        "product_reference": "libssh-main@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libssh-main@noarch as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:libssh-main@noarch"
        },
        "product_reference": "libssh-main@noarch",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libssh-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:libssh-main@src"
        },
        "product_reference": "libssh-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libssh-main@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:libssh-main@x86_64"
        },
        "product_reference": "libssh-main@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Martin Grubhofer"
          ]
        }
      ],
      "cve": "CVE-2025-14821",
      "cwe": {
        "id": "CWE-427",
        "name": "Uncontrolled Search Path Element"
      },
      "discovery_date": "2025-12-17T11:43:02.072000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2423148"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libssh. This vulnerability allows local man-in-the-middle attacks, security downgrades of SSH (Secure Shell) connections, and manipulation of trusted host information, posing a significant risk to the confidentiality, integrity, and availability of SSH communications via an insecure default configuration on Windows systems where the library automatically loads configuration files from the C:\\etc directory, which can be created and modified by unprivileged local users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libssh: libssh: Insecure default configuration leads to local man-in-the-middle attacks on Windows",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Low for Red Hat products. The flaw in libssh is specific to its insecure default configuration on Windows systems, where it loads configuration from the C:\\etc directory. Red Hat\u0027s Linux-based products do not utilize this configuration path, and therefore are not affected by this vulnerability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:libssh-main@aarch64",
          "Red Hat Hardened Images:libssh-main@noarch",
          "Red Hat Hardened Images:libssh-main@src",
          "Red Hat Hardened Images:libssh-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-14821"
        },
        {
          "category": "external",
          "summary": "RHBZ#2423148",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423148"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-14821",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-14821"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14821",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14821"
        },
        {
          "category": "external",
          "summary": "https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/",
          "url": "https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/"
        }
      ],
      "release_date": "2026-02-10T18:51:56.639000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T13:23:35+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7067"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "libssh: libssh: Insecure default configuration leads to local man-in-the-middle attacks on Windows"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Kang Yang",
            "Yunhang Zhang",
            "Jun Xu"
          ]
        },
        {
          "names": [
            "Jakub Jelen"
          ],
          "organization": "libssh"
        }
      ],
      "cve": "CVE-2026-0966",
      "cwe": {
        "id": "CWE-124",
        "name": "Buffer Underwrite (\u0027Buffer Underflow\u0027)"
      },
      "discovery_date": "2026-01-26T23:14:46.617000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2433121"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The API function `ssh_get_hexa()` is vulnerable, when 0-lenght\ninput is provided to this function. This function is used internally\nin `ssh_get_fingerprint_hash()` and `ssh_print_hexa()` (deprecated),\nwhich is vulnerable to the same input (length is provided by the\ncalling application).\n\nThe function is also used internally in the gssapi code for logging\nthe OIDs received by the server during GSSAPI authentication. This\ncould be triggered remotely, when the server allows GSSAPI authentication\nand logging verbosity is set at least to SSH_LOG_PACKET (3). This\ncould cause self-DoS of the per-connection daemon process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libssh: Buffer underflow in ssh_get_hexa() on invalid input",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:libssh-main@aarch64",
          "Red Hat Hardened Images:libssh-main@noarch",
          "Red Hat Hardened Images:libssh-main@src",
          "Red Hat Hardened Images:libssh-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-0966"
        },
        {
          "category": "external",
          "summary": "RHBZ#2433121",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433121"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-0966",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-0966"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0966",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0966"
        },
        {
          "category": "external",
          "summary": "https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/",
          "url": "https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/"
        }
      ],
      "release_date": "2026-02-10T18:47:15.531000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T13:23:35+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7067"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, consider disabling GSSAPI authentication if it is not required, or reduce the `LogLevel` in the `sshd_config` file to a value lower than `SSH_LOG_PACKET` (e.g., `INFO`).\n\nTo disable GSSAPI authentication, add or modify the following line in `/etc/ssh/sshd_config`:\n`GSSAPIAuthentication no`\n\nTo reduce logging verbosity, add or modify the following line in `/etc/ssh/sshd_config`:\n`LogLevel INFO`\n\nAfter making changes to `sshd_config`, the `sshd` service must be restarted for the changes to take effect. This may temporarily interrupt active SSH sessions.",
          "product_ids": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.0"
          },
          "products": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libssh: Buffer underflow in ssh_get_hexa() on invalid input"
    },
    {
      "cve": "CVE-2026-3731",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-03-08T11:01:00.569703+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2445579"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libssh. A remote attacker could trigger an out-of-bounds read vulnerability in the SFTP Extension Name Handler by manipulating the `idx` argument in the `sftp_extensions_get_name` or `sftp_extensions_get_data` functions. This could lead to a Denial of Service (DoS), making the affected system unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libssh: libssh: Denial of Service via out-of-bounds read in SFTP extension name handler",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A MODERATE impact out-of-bounds read vulnerability exists in libssh\u0027s SFTP extension. A remote attacker could exploit this flaw by manipulating an argument to the `sftp_extensions_get_name/sftp_extensions_get_data` functions, potentially leading to a denial of service or information disclosure. This affects Red Hat Enterprise Linux versions utilizing libssh.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:libssh-main@aarch64",
          "Red Hat Hardened Images:libssh-main@noarch",
          "Red Hat Hardened Images:libssh-main@src",
          "Red Hat Hardened Images:libssh-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-3731"
        },
        {
          "category": "external",
          "summary": "RHBZ#2445579",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445579"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-3731",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-3731"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3731",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3731"
        },
        {
          "category": "external",
          "summary": "https://gitlab.com/libssh/libssh-mirror/-/commit/855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60",
          "url": "https://gitlab.com/libssh/libssh-mirror/-/commit/855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/?ctiid.349709",
          "url": "https://vuldb.com/?ctiid.349709"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/?id.349709",
          "url": "https://vuldb.com/?id.349709"
        },
        {
          "category": "external",
          "summary": "https://vuldb.com/?submit.767120",
          "url": "https://vuldb.com/?submit.767120"
        },
        {
          "category": "external",
          "summary": "https://www.libssh.org/files/0.12/libssh-0.12.0.tar.xz",
          "url": "https://www.libssh.org/files/0.12/libssh-0.12.0.tar.xz"
        },
        {
          "category": "external",
          "summary": "https://www.libssh.org/security/advisories/libssh-2026-sftp-extensions.txt",
          "url": "https://www.libssh.org/security/advisories/libssh-2026-sftp-extensions.txt"
        }
      ],
      "release_date": "2026-03-08T10:32:19.482000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-08T13:23:35+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:7067"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:libssh-main@aarch64",
            "Red Hat Hardened Images:libssh-main@noarch",
            "Red Hat Hardened Images:libssh-main@src",
            "Red Hat Hardened Images:libssh-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libssh: libssh: Denial of Service via out-of-bounds read in SFTP extension name handler"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.