The vulnerability CVE-2026-0965 affects libssh, a library implementing the SSH protocol, where improper handling of configuration files can lead to attempts to open arbitrary files. This flaw can be exploited locally by providing malicious configuration files or exploiting system misconfigurations, resulting in a Denial of Service by accessing dangerous files such as block devices or large system files. Red Hat has released updated libssh packages for Red Hat Enterprise Linux 10 that fix this issue as part of a broader security update addressing multiple libssh vulnerabilities.

The impact of CVE-2026-0965 is limited to Denial of Service (DoS) conditions caused by libssh attempting to open arbitrary files during configuration parsing. There is no impact on confidentiality or integrity. The vulnerability requires local access with low privileges and does not involve user interaction. No known exploits are reported in the wild. The CVSS score is 3.3 (low severity), reflecting the limited impact and attack complexity.

Red Hat has released official patches for libssh in Red Hat Enterprise Linux 10 that address CVE-2026-0965 along with other libssh vulnerabilities. Users should apply the updated libssh packages as detailed in the Red Hat advisory RHSA-2026:18160 available at https://access.redhat.com/errata/RHSA-2026:18160 and follow the update instructions at https://access.redhat.com/articles/11258. Applying these updates fully mitigates the vulnerability. No additional mitigation steps are required beyond applying the official fix.