A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when… (CVE-2026-59849)
A logic error in libssh's automatic certificate-based public key authentication can cause clients to enter an indefinite loop when configured certificates are missing or repeatedly rejected by a server. This results in a denial of service condition. The vulnerability is identified as CVE-2026-59849 and has a low severity rating. Red Hat has released an update for libssh in their Hardened Images RPMs to address this issue.
AI Analysis
Technical Summary
CVE-2026-59849 is a vulnerability in libssh where logic errors in the automatic certificate-based public key authentication mechanism cause libssh clients to loop indefinitely if the configured certificates are missing or repeatedly rejected by the server. This behavior leads to a denial of service (DoS) condition. The vulnerability is categorized under CWE-835 (Loop with Unreachable Exit Condition). Red Hat has issued a security advisory (RHSA-2026:42922) providing updated libssh packages (libssh-0.12.1-4.hum1) that fix this issue in their Hardened Images RPMs.
Potential Impact
The impact of this vulnerability is limited to denial of service caused by libssh clients looping indefinitely during authentication attempts when certificates are missing or rejected. There is no confidentiality or integrity impact reported. The CVSS vector indicates low severity with network attack vector, high attack complexity, low privileges required, no user interaction, and only availability impact.
Mitigation Recommendations
Red Hat has released updated libssh packages as part of their Hardened Images RPMs to address this vulnerability. Users of affected Red Hat Hardened Images should apply the update libssh-0.12.1-4.hum1 or later as provided in advisory RHSA-2026:42922. Patch status is confirmed as fixed by the vendor advisory. No additional mitigation steps are indicated.
A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when… (CVE-2026-59849)
Description
A logic error in libssh's automatic certificate-based public key authentication can cause clients to enter an indefinite loop when configured certificates are missing or repeatedly rejected by a server. This results in a denial of service condition. The vulnerability is identified as CVE-2026-59849 and has a low severity rating. Red Hat has released an update for libssh in their Hardened Images RPMs to address this issue.
CVSS v3.1
Score 3.1low
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-59849 is a vulnerability in libssh where logic errors in the automatic certificate-based public key authentication mechanism cause libssh clients to loop indefinitely if the configured certificates are missing or repeatedly rejected by the server. This behavior leads to a denial of service (DoS) condition. The vulnerability is categorized under CWE-835 (Loop with Unreachable Exit Condition). Red Hat has issued a security advisory (RHSA-2026:42922) providing updated libssh packages (libssh-0.12.1-4.hum1) that fix this issue in their Hardened Images RPMs.
Potential Impact
The impact of this vulnerability is limited to denial of service caused by libssh clients looping indefinitely during authentication attempts when certificates are missing or rejected. There is no confidentiality or integrity impact reported. The CVSS vector indicates low severity with network attack vector, high attack complexity, low privileges required, no user interaction, and only availability impact.
Mitigation Recommendations
Red Hat has released updated libssh packages as part of their Hardened Images RPMs to address this vulnerability. Users of affected Red Hat Hardened Images should apply the update libssh-0.12.1-4.hum1 or later as provided in advisory RHSA-2026:42922. Patch status is confirmed as fixed by the vendor advisory. No additional mitigation steps are indicated.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-jp6g-7mqj-wj53
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-59849"]
- Ecosystems
- []
- Database Specific Severity
- LOW
- Cvss Version
- 3.1
Threat ID: 6a6150e19c2644c7f8da17ba
Added to database: 07/22/2026, 23:23:13 UTC
Last enriched: 07/22/2026, 23:35:24 UTC
Last updated: 07/31/2026, 19:24:50 UTC
Views: 23
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.