CVE-2026-0966: Buffer Underwrite ('Buffer Underflow') in Red Hat Red Hat Enterprise Linux 10
A flaw was found in libssh. The API function `ssh_get_hexa()` is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI (Generic Security Service Application Program Interface) authentication if the server's logging verbosity is set to `SSH_LOG_PACKET (3)` or higher. Successful exploitation could lead to a self-Denial of Service of the per-connection daemon process.
AI Analysis
Technical Summary
This vulnerability in libssh's ssh_get_hexa() function causes a buffer underwrite (buffer underflow) when processing zero-length input. An attacker can remotely trigger this condition during GSSAPI authentication if the SSH server's logging verbosity is set to 3 or higher, leading to a denial of service by crashing the per-connection daemon process. The issue affects Red Hat Enterprise Linux 10 across multiple architectures. Red Hat has issued a security advisory (RHSA-2026:18160) providing updated libssh packages (version 0.12.0) that fix this and several other libssh vulnerabilities. The CVSS 3.0 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H with a base score of 6.5, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact.
Potential Impact
The vulnerability allows a remote attacker to cause a denial of service by crashing the per-connection daemon process during GSSAPI authentication under specific logging conditions. This disrupts availability of the SSH service for affected connections but does not impact confidentiality or integrity of data. There are no known exploits in the wild currently. The impact is rated as medium severity with a CVSS score of 6.5.
Mitigation Recommendations
Red Hat has released an official security update for Red Hat Enterprise Linux 10 that addresses this vulnerability by updating libssh to version 0.12.0. Users should apply the update as described in Red Hat advisory RHSA-2026:18160 and the referenced article https://access.redhat.com/articles/11258 to remediate this issue. No additional mitigation steps are required beyond applying the official patch.
CVE-2026-0966: Buffer Underwrite ('Buffer Underflow') in Red Hat Red Hat Enterprise Linux 10
Description
A flaw was found in libssh. The API function `ssh_get_hexa()` is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI (Generic Security Service Application Program Interface) authentication if the server's logging verbosity is set to `SSH_LOG_PACKET (3)` or higher. Successful exploitation could lead to a self-Denial of Service of the per-connection daemon process.
CVSS v3.0
Score 6.5medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in libssh's ssh_get_hexa() function causes a buffer underwrite (buffer underflow) when processing zero-length input. An attacker can remotely trigger this condition during GSSAPI authentication if the SSH server's logging verbosity is set to 3 or higher, leading to a denial of service by crashing the per-connection daemon process. The issue affects Red Hat Enterprise Linux 10 across multiple architectures. Red Hat has issued a security advisory (RHSA-2026:18160) providing updated libssh packages (version 0.12.0) that fix this and several other libssh vulnerabilities. The CVSS 3.0 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H with a base score of 6.5, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact.
Potential Impact
The vulnerability allows a remote attacker to cause a denial of service by crashing the per-connection daemon process during GSSAPI authentication under specific logging conditions. This disrupts availability of the SSH service for affected connections but does not impact confidentiality or integrity of data. There are no known exploits in the wild currently. The impact is rated as medium severity with a CVSS score of 6.5.
Mitigation Recommendations
Red Hat has released an official security update for Red Hat Enterprise Linux 10 that addresses this vulnerability by updating libssh to version 0.12.0. Users should apply the update as described in Red Hat advisory RHSA-2026:18160 and the referenced article https://access.redhat.com/articles/11258 to remediate this issue. No additional mitigation steps are required beyond applying the official patch.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-01-14T21:54:59.132Z
- Cvss Version
- 3.0
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/errata/RHSA-2026:7067","vendor":"Red Hat"},{"url":"https://access.redhat.com/security/cve/CVE-2026-0966","vendor":"Red Hat"}]
Threat ID: 69c5a54b3c064ed76fcfc842
Added to database: 03/26/2026, 21:29:47 UTC
Last enriched: 05/25/2026, 19:27:57 UTC
Last updated: 07/31/2026, 19:22:57 UTC
Views: 141
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.