Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2026:3076-1

Опубликовано: 16 июл. 2026
Источник: suse-cvrf

Описание

Security update for libssh2_org

This update for libssh2_org fixes the following issue

  • CVE-2026-55199: pre-Authentication DoS via SSH_MSG_EXT_INFO Handler (bsc#1268530).

Список пакетов

SUSE Linux Enterprise Module for Basesystem 15 SP7
libssh2-1-1.11.0-150600.20.3.1
libssh2-1-32bit-1.11.0-150600.20.3.1
libssh2-devel-1.11.0-150600.20.3.1
SUSE Linux Enterprise Server 15 SP6-LTSS
libssh2-1-1.11.0-150600.20.3.1
libssh2-1-32bit-1.11.0-150600.20.3.1
libssh2-devel-1.11.0-150600.20.3.1
SUSE Linux Enterprise Server for SAP Applications 15 SP6
libssh2-1-1.11.0-150600.20.3.1
libssh2-1-32bit-1.11.0-150600.20.3.1
libssh2-devel-1.11.0-150600.20.3.1

Ссылки

Описание

libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can set nr_extensions to 0xFFFFFFFF during key exchange, causing the client to spin in a tight CPU loop for over 60 seconds because return values from _libssh2_get_string() are unchecked and the session timeout does not apply to CPU-bound loops.

Затронутые продукты
SUSE Linux Enterprise Module for Basesystem 15 SP7:libssh2-1-1.11.0-150600.20.3.1
SUSE Linux Enterprise Module for Basesystem 15 SP7:libssh2-1-32bit-1.11.0-150600.20.3.1
SUSE Linux Enterprise Module for Basesystem 15 SP7:libssh2-devel-1.11.0-150600.20.3.1
SUSE Linux Enterprise Server 15 SP6-LTSS:libssh2-1-1.11.0-150600.20.3.1
Ссылки