CVE-2026-59842

Опубликовано: 21 июл. 2026

Источник: nvd

CVSS3: 3.7

CVSS3: 5.3

EPSS Низкий

Описание

A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length is copied without proper length validation, leading to an out-of-bounds heap read. This could allow a remote unauthenticated attacker to disclose small amounts of server memory.

Ссылки

https://access.redhat.com/errata/RHSA-2026:42922
Issue Tracking
https://access.redhat.com/errata/RHSA-2026:55855
Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-59842
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2498168
Issue Tracking
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:libssh:libssh:0.12.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:hardened_images:-:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:arm64:*

cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:x64:*

cpe:2.3:o:redhat:enterprise_linux:10.2:*:*:*:*:*:arm64:*

cpe:2.3:o:redhat:enterprise_linux:10.2:*:*:*:*:*:x64:*

cpe:2.3:o:redhat:enterprise_linux_for_els:10.2:*:*:*:*:*:arm64:*

cpe:2.3:o:redhat:enterprise_linux_for_els:10.2:*:*:*:*:*:x64:*

cpe:2.3:o:redhat:enterprise_linux_for_eus:10.2:*:*:*:*:*:arm64:*

cpe:2.3:o:redhat:enterprise_linux_for_eus:10.2:*:*:*:*:*:x64:*

cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:10.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:10.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_els:10.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:10.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:10.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:10.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_els:10.2:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:10.2:*:*:*:*:*:*:*

EPSS

Процентиль: 43%

0.00493

Низкий

3.7 Low

CVSS3

5.3 Medium

CVSS3

Дефекты

CWE-125

Связанные уязвимости

CVE-2026-59842

CVSS3: 5.3

ubuntu

4 месяца назад

CVE-2026-59842

CVSS3: 3.7

redhat

4 месяца назад

CVE-2026-59842

CVSS3: 5.3

debian

4 месяца назад

A flaw was found in libssh. During server-side GSSAPI key exchange, a ...

ROS-20260907-80-0007

CVSS3: 5.3

redos

2 месяца назад

Уязвимость libssh

ROS-20260907-73-0007

CVSS3: 5.3

redos

2 месяца назад

Уязвимость libssh

EPSS

Процентиль: 43%

0.00493

Низкий

3.7 Low

CVSS3

5.3 Medium

CVSS3

Дефекты

CWE-125