A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then… (CVE-2026-59845)
A vulnerability in libssh affects the ProxyCommand feature, where an unchecked fork() failure can be recorded as process ID -1. During cleanup, this can cause signals to be sent across the caller's accessible process tree, resulting in a local denial of service. This issue impacts environments using ProxyCommand in libssh client configurations.
AI Analysis
Technical Summary
CVE-2026-59845 describes a flaw in libssh's handling of the ProxyCommand feature. If fork() fails and the failure is not checked, the process ID -1 may be stored. Subsequently, during cleanup, signals may be sent improperly across the process tree accessible to the caller, causing a local denial of service. This vulnerability is classified under CWE-390 (Detection of Error Condition Without Action). The issue specifically affects client-side ProxyCommand usage in libssh.
Potential Impact
The vulnerability can lead to a local denial of service by disrupting system availability when ProxyCommand is used in libssh. There is no impact on confidentiality or integrity, but availability is affected due to signals being sent erroneously across processes. The CVSS v3.1 base score is 5.3 (medium severity), reflecting local attack vector, high attack complexity, low privileges required, and user interaction required.
Mitigation Recommendations
Red Hat advises avoiding the use of the ProxyCommand feature in libssh client configurations to mitigate this issue. This prevents the vulnerable code path from being exercised and eliminates the risk of local denial of service caused by unchecked fork() failures. A fixed package version (libssh-0.12.1-4.hum1) is available in Red Hat Hardened Images RPMs. Users should apply this update where applicable.
A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then… (CVE-2026-59845)
Description
A vulnerability in libssh affects the ProxyCommand feature, where an unchecked fork() failure can be recorded as process ID -1. During cleanup, this can cause signals to be sent across the caller's accessible process tree, resulting in a local denial of service. This issue impacts environments using ProxyCommand in libssh client configurations.
CVSS v3.1
Score 5.3medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-59845 describes a flaw in libssh's handling of the ProxyCommand feature. If fork() fails and the failure is not checked, the process ID -1 may be stored. Subsequently, during cleanup, signals may be sent improperly across the process tree accessible to the caller, causing a local denial of service. This vulnerability is classified under CWE-390 (Detection of Error Condition Without Action). The issue specifically affects client-side ProxyCommand usage in libssh.
Potential Impact
The vulnerability can lead to a local denial of service by disrupting system availability when ProxyCommand is used in libssh. There is no impact on confidentiality or integrity, but availability is affected due to signals being sent erroneously across processes. The CVSS v3.1 base score is 5.3 (medium severity), reflecting local attack vector, high attack complexity, low privileges required, and user interaction required.
Mitigation Recommendations
Red Hat advises avoiding the use of the ProxyCommand feature in libssh client configurations to mitigate this issue. This prevents the vulnerable code path from being exercised and eliminates the risk of local denial of service caused by unchecked fork() failures. A fixed package version (libssh-0.12.1-4.hum1) is available in Red Hat Hardened Images RPMs. Users should apply this update where applicable.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-97fp-2vw9-q5jg
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-59845"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a6150e69c2644c7f8da1e7d
Added to database: 07/22/2026, 23:23:18 UTC
Last enriched: 09/13/2026, 20:04:47 UTC
Last updated: 09/14/2026, 10:01:32 UTC
Views: 98
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.