A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when… (CVE-2026-59849)
A logic flaw in libssh's automatic certificate-based public key authentication can cause clients to enter an infinite loop when configured certificates are missing or repeatedly rejected by a server. This results in a denial of service due to resource exhaustion. The vulnerability has a low severity score and does not impact confidentiality or integrity. A security update is available from Red Hat to address this issue.
AI Analysis
Technical Summary
This vulnerability in libssh arises from logic errors in the automatic certificate-based public key authentication mechanism. When configured certificates are missing or repeatedly rejected by an SSH server, libssh clients may loop indefinitely, causing a denial of service through resource consumption such as CPU cycles. The issue is tracked as CWE-835 (Loop with Unreachable Exit Condition). Red Hat has issued a security advisory (RHSA-2026:42922) providing updated libssh packages (version 0.12.1-4.hum1) for Red Hat Hardened Images to fix this flaw. The CVSS v3.1 base score is 3.1, reflecting low severity with network attack vector, high attack complexity, and low privileges required.
Potential Impact
The vulnerability causes denial of service by making libssh clients enter an infinite loop during automatic certificate authentication when certificates are missing or rejected. This leads to resource exhaustion such as CPU consumption and potentially degraded system responsiveness. There is no impact on confidentiality or integrity. The CVSS score is low (3.1), indicating limited impact primarily on availability.
Mitigation Recommendations
Red Hat has released updated libssh packages to fix this vulnerability. Users should apply the security update RHSA-2026:42922 which includes libssh version 0.12.1-4.hum1. Until patched, it is recommended to avoid connecting to untrusted SSH servers and not to use certificate-based authentication. No other mitigations are specified by Red Hat.
A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when… (CVE-2026-59849)
Description
A logic flaw in libssh's automatic certificate-based public key authentication can cause clients to enter an infinite loop when configured certificates are missing or repeatedly rejected by a server. This results in a denial of service due to resource exhaustion. The vulnerability has a low severity score and does not impact confidentiality or integrity. A security update is available from Red Hat to address this issue.
CVSS v3.1
Score 3.1low
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in libssh arises from logic errors in the automatic certificate-based public key authentication mechanism. When configured certificates are missing or repeatedly rejected by an SSH server, libssh clients may loop indefinitely, causing a denial of service through resource consumption such as CPU cycles. The issue is tracked as CWE-835 (Loop with Unreachable Exit Condition). Red Hat has issued a security advisory (RHSA-2026:42922) providing updated libssh packages (version 0.12.1-4.hum1) for Red Hat Hardened Images to fix this flaw. The CVSS v3.1 base score is 3.1, reflecting low severity with network attack vector, high attack complexity, and low privileges required.
Potential Impact
The vulnerability causes denial of service by making libssh clients enter an infinite loop during automatic certificate authentication when certificates are missing or rejected. This leads to resource exhaustion such as CPU consumption and potentially degraded system responsiveness. There is no impact on confidentiality or integrity. The CVSS score is low (3.1), indicating limited impact primarily on availability.
Mitigation Recommendations
Red Hat has released updated libssh packages to fix this vulnerability. Users should apply the security update RHSA-2026:42922 which includes libssh version 0.12.1-4.hum1. Until patched, it is recommended to avoid connecting to untrusted SSH servers and not to use certificate-based authentication. No other mitigations are specified by Red Hat.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-jp6g-7mqj-wj53
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-59849"]
- Database Specific Severity
- LOW
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a6150e19c2644c7f8da17ba
Added to database: 07/22/2026, 23:23:13 UTC
Last enriched: 08/19/2026, 16:17:04 UTC
Last updated: 09/14/2026, 22:01:35 UTC
Views: 107
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.