CVE-2026-59842 is a vulnerability in libssh where during the server-side GSSAPI key exchange, a client-supplied Curve25519 public key that is shorter than the expected length is copied without proper length validation. This results in an out-of-bounds heap read (CWE-125), potentially allowing a remote unauthenticated attacker to disclose small amounts of server memory. The flaw affects confidentiality by exposing memory contents that may include sensitive information. Red Hat has issued security advisories and updated libssh RPM packages (version 0.12.1-4.hum1) to fix this issue. Mitigation options include disabling the vulnerable key exchange mechanism or removing the affected algorithm from configuration. No known exploits in the wild have been reported.

The vulnerability allows remote unauthenticated attackers to read out-of-bounds memory on the server during GSSAPI key exchange, potentially disclosing small amounts of sensitive server memory. This could include cryptographic keys or memory addresses that might aid in bypassing protection mechanisms. There is no impact on integrity or availability reported. The overall severity is low with a CVSS score of 3.7.

Red Hat has released updated libssh packages (libssh-0.12.1-4.hum1) that address this vulnerability. Users should apply these updates as soon as possible. Alternatively, disabling GSSAPIKeyExchange or removing the gss-curve25519-sha256- algorithm from GSSAPIKexAlgorithms can mitigate the issue if patching is not immediately feasible. There are no indications that no action is required; remediation is recommended.