CVE-2026-59849

Analyzed Analyzed - Analysis Complete

libssh Client Denial of Service via Certificate Authentication Loop

Publication date: 2026-07-21

Last updated on: 2026-09-22

Assigner: redhat-SADP

Description

A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when configured certificates are missing or repeatedly rejected by a server, leading to denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-09-22

Generated

2026-10-11

AI Q&A

2026-07-21

EPSS Evaluated

2026-10-10

NVD

CVE-2026-59849

EUVD

EUVD-2026-46263

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	enterprise_linux	10.0
redhat	enterprise_linux	10.2
redhat	enterprise_linux_for_els	10.2
redhat	enterprise_linux_for_eus	10.2
redhat	enterprise_linux_for_ibm_z_systems	10.2
redhat	enterprise_linux_for_ibm_z_systems_els	10.2
redhat	enterprise_linux_for_ibm_z_systems_eus	10.2
redhat	enterprise_linux_for_power_little_endian	10.0
redhat	enterprise_linux_for_power_little_endian	10.2
redhat	enterprise_linux	10.0
redhat	enterprise_linux	10.2
redhat	enterprise_linux_for_els	10.2
redhat	enterprise_linux_for_eus	10.2
redhat	enterprise_linux_for_power_little_endian_els	10.2
redhat	enterprise_linux_for_power_little_endian_eus	10.2
redhat	enterprise_linux_for_ibm_z_systems	10.0
redhat	enterprise_linux	10.0
redhat	hardened_images	*
libssh	libssh	0.12.0
libssh	libssh	From 0.11.0 (inc) to 0.11.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-835	The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

Executive Summary

CVE-2026-59849 is a flaw in libssh where logic errors in automatic certificate-based public key authentication cause clients to loop indefinitely. This happens when configured certificates are missing or rejected by a server, leading to a denial of service.

Detection Guidance

To detect this vulnerability, monitor for processes using libssh that hang indefinitely during certificate-based authentication attempts. Check for repeated failed authentication loops in logs or system monitoring tools. No specific commands are provided in the context, but inspecting libssh client logs for repeated authentication failures may indicate exploitation.

Impact Analysis

This vulnerability can cause a denial of service by making the libssh client hang indefinitely during authentication attempts. It only affects non-default certificate configurations and does not impact default setups.

Compliance Impact

This vulnerability causes a denial of service via an infinite loop during certificate-based authentication, which could disrupt system availability. While it does not directly impact data confidentiality or integrity, prolonged service disruption may violate availability requirements in standards like GDPR (Article 32) or HIPAA (Security Rule). However, the issue is low severity and only affects non-default certificate configurations.

Mitigation Strategies

Avoid using automatic certificate-based public key authentication in libssh clients. If certificates are required, ensure proper configuration and server acceptance to prevent infinite loops. Monitor for unusual client behavior indicating repeated authentication attempts.

Hi! I’m here to help you understand CVE-2026-59849. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70