{"attribution":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","cve":{"id":"CVE-2026-59849","sourceIdentifier":"secalert@redhat.com","published":"2026-07-21T15:16:37.647","lastModified":"2026-11-06T20:17:23.700","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when configured certificates are missing or repeatedly rejected by a server, leading to denial of service."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"libssh","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"versions":[{"version":"0:0.12.0-3.el10_2","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Hardened Images","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"libssh-main","cpes":["cpe:/a:redhat:hummingbird:1"],"versions":[{"version":"0.12.1-4.hum1","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"libssh","cpes":["cpe:/a:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"libssh","cpes":["cpe:/a:redhat:enterprise_linux:9"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","baseScore":3.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.6,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-22T14:31:02.938864Z","id":"CVE-2026-59849","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-835"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:libssh:libssh:*:*:*:*:*:*:*:*","versionStartIncluding":"0.11.0","versionEndExcluding":"0.11.5","matchCriteriaId":"1AB6D376-A470-41DB-BEA0-77F711432B7A"},{"vulnerable":true,"criteria":"cpe:2.3:a:libssh:libssh:0.12.0:*:*:*:*:*:*:*","matchCriteriaId":"C250851D-1948-4012-ABE4-FEBB369E3231"},{"vulnerable":true,"criteria":"cpe:2.3:a:redhat:hardened_images:-:*:*:*:*:*:*:*","matchCriteriaId":"87DEB507-5B64-47D7-9A50-3B87FD1E571F"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*","matchCriteriaId":"D65C2163-CFC2-4ABB-8F4E-CB09CEBD006C"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:arm64:*","matchCriteriaId":"63D81CCC-AECF-436A-B019-B3149585F92C"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:x64:*","matchCriteriaId":"472208E5-9850-47CD-8C7D-E1EBF7FDB2C7"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:10.2:*:*:*:*:*:arm64:*","matchCriteriaId":"4DBA7603-2980-42BE-981C-FAE97568B00B"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux:10.2:*:*:*:*:*:x64:*","matchCriteriaId":"D28BC9F4-ECC6-411B-B445-B247FACD9530"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_for_els:10.2:*:*:*:*:*:arm64:*","matchCriteriaId":"C78AA720-6EBB-4CA7-8831-22A7CBFE7A1C"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_for_els:10.2:*:*:*:*:*:x64:*","matchCriteriaId":"1D055CB8-FA3A-4DB8-AB58-9B17F7EC552B"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_for_eus:10.2:*:*:*:*:*:arm64:*","matchCriteriaId":"ADFDF403-9B07-48CF-8BB2-11054879BCF8"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_for_eus:10.2:*:*:*:*:*:x64:*","matchCriteriaId":"E7AB6D4F-D513-45F8-BC00-5F6C93D0002D"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:10.0:*:*:*:*:*:*:*","matchCriteriaId":"31F91BA6-64D9-4248-8773-6B5B99CA01A0"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:10.2:*:*:*:*:*:*:*","matchCriteriaId":"157996FE-FC8B-4D4E-9538-E14BC0D8466F"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_els:10.2:*:*:*:*:*:*:*","matchCriteriaId":"1B8AC302-55C1-44FB-B66C-C6D0D6F5DBFE"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:10.2:*:*:*:*:*:*:*","matchCriteriaId":"F7F02954-7CB7-46F9-BBF1-3FAD6736F712"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:10.0:*:*:*:*:*:*:*","matchCriteriaId":"06A3271F-112F-4FB7-A2F7-6401A365FCBA"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:10.2:*:*:*:*:*:*:*","matchCriteriaId":"D6F30042-532F-4A7C-897B-1084C0587957"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_els:10.2:*:*:*:*:*:*:*","matchCriteriaId":"9BB0DAF9-794A-4DAF-A4C6-3DDD8E42F48D"},{"vulnerable":true,"criteria":"cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:10.2:*:*:*:*:*:*:*","matchCriteriaId":"DDDCBC52-F003-4776-8D21-B525CF8D8B8D"}]}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:42922","source":"secalert@redhat.com","tags":["Issue Tracking"]},{"url":"https://access.redhat.com/errata/RHSA-2026:55855","source":"secalert@redhat.com","tags":["Vendor Advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59849","source":"secalert@redhat.com","tags":["Vendor Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498182","source":"secalert@redhat.com","tags":["Issue Tracking","Vendor Advisory"]}]}}