CVE-2026-0965

Libssh: libssh: denial of service via improper configuration file handling

Published Mar 26, 2026 CVSS 3.0 · 3.3 Low EPSS < 1% KEV · Not listed
Description
A flaw was found in libssh where it can attempt to open arbitrary files during configuration parsing. A local attacker can exploit this by providing a malicious configuration file or when the system is misconfigured. This vulnerability could lead to a Denial of Service (DoS) by causing the system to try and access dangerous files, such as block devices or large system files, which can disrupt normal operations.

Remediation

Vendor Workaround

Ensure the client and server are using only regular files as configuration.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4844-1 libssh security update
Debian DSA Debian DSA DSA-6410-1 libssh security update
Ubuntu USN Ubuntu USN USN-8051-2 libssh vulnerabilities
Ubuntu USN Ubuntu USN USN-8051-1 libssh vulnerabilities
History
Type Values Removed Values Added
First Time appeared Redhat rhel Els
CPEs cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/a:redhat:enterprise_linux:8
cpe:/o:redhat:rhel_els:6
cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat rhel Els
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:9 cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/o:redhat:enterprise_linux:9::baseos
References
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:10 cpe:/o:redhat:enterprise_linux:10.2
References
Type Values Removed Values Added
First Time appeared Redhat hummingbird
CPEs cpe:/a:redhat:hummingbird:1
Vendors & Products Redhat hummingbird
Type Values Removed Values Added
CPEs cpe:2.3:a:libssh:libssh:*:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
Description No description is available for this CVE. A flaw was found in libssh where it can attempt to open arbitrary files during configuration parsing. A local attacker can exploit this by providing a malicious configuration file or when the system is misconfigured. This vulnerability could lead to a Denial of Service (DoS) by causing the system to try and access dangerous files, such as block devices or large system files, which can disrupt normal operations.
Title libssh: libssh: Denial of Service via improper configuration file handling Libssh: libssh: denial of service via improper configuration file handling
First Time appeared Redhat
Redhat enterprise Linux
Redhat openshift
CPEs cpe:/a:redhat:openshift:4
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
Redhat openshift
References
Type Values Removed Values Added
First Time appeared Libssh
Libssh libssh
Vendors & Products Libssh
Libssh libssh
Type Values Removed Values Added
Description No description is available for this CVE.
Title libssh: libssh: Denial of Service via improper configuration file handling
Weaknesses CWE-73
References
Metrics threat_severity

None

cvssV3_0

{'score': 3.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'}

threat_severity

Low

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Nov 6, 2026, 5:49 PM
Reserved
Jan 14, 2026, 9:54 PM
Status
Modified
Published
Mar 26, 2026, 9:17 PM
Modified
Nov 6, 2026, 6:17 PM
Severity
Low
Public date
Feb 10, 2026, 6:47 PM