CVE-2026-59845

Undergoing Analysis Undergoing Analysis - In Progress

libssh ProxyCommand Local Denial of Service

Publication date: 2026-07-21

Last updated on: 2026-07-30

Assigner: Red Hat, Inc.

Description

A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-30

Generated

2026-08-10

AI Q&A

2026-07-21

EPSS Evaluated

2026-08-09

NVD

CVE-2026-59845

EUVD

EUVD-2026-46178

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	enterprise_linux	8.0
redhat	enterprise_linux	9.0
libssh	libssh	*
redhat	enterprise_linux	10.0
redhat	hardened_images	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-390	The product detects a specific error, but takes no actions to handle the error.

Attack-Flow Graph

Executive Summary

This vulnerability is in libssh where ProxyCommand is used. If fork() fails, it returns -1 which is stored as a process ID. During cleanup, signals may be sent to unintended processes, causing a local denial of service.

Detection Guidance

Check if libssh is installed and ProxyCommand is configured in SSH client configurations. Look for processes using libssh with ProxyCommand settings. Commands like 'ps aux | grep ssh' or 'ss -tulnp | grep ssh' may help identify active SSH sessions.

Impact Analysis

It can cause a local denial of service by disrupting processes in your system if ProxyCommand is used with libssh. This may lead to system instability or unresponsiveness.

Compliance Impact

This vulnerability primarily causes a local denial of service by sending signals across the caller's process tree due to improper fork() failure handling. It does not directly impact data confidentiality or integrity, which are key concerns for GDPR or HIPAA. However, a denial of service could indirectly affect compliance by disrupting services handling sensitive data.

Mitigation Strategies

Update libssh to the latest patched version. Disable ProxyCommand in SSH client configurations if not required. Monitor system logs for unusual signal-related activities or process tree modifications.

Hi! I’m here to help you understand CVE-2026-59845. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70