CVE-2026-59847: Incorrect Check of Function Return Value in Red Hat Red Hat Enterprise Linux 10
A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection.
AI Analysis
Technical Summary
This vulnerability in libssh arises from incorrect checks of the AES-GCM finalization when using the OpenSSL backend, effectively removing integrity protection. This flaw allows an in-path attacker to modify plaintext data on the wire without detection. The issue is tracked as CWE-253 (Incorrect Check of Function Return Value). Red Hat has issued an update for libssh (version 0.12.1-4.hum1) in Red Hat Hardened Images to fix this problem. The CVSS v3.1 base score is 5.9 (medium severity), reflecting a network attack vector with high attack complexity and no privileges or user interaction required. The vulnerability impacts integrity but not confidentiality or availability.
Potential Impact
An attacker positioned in the network path can modify plaintext data transmitted over libssh connections without detection due to the removal of integrity protection caused by incorrect AES-GCM finalization checks. This compromises data integrity but does not affect confidentiality or availability. There are no known exploits in the wild at this time.
Mitigation Recommendations
Red Hat has released updated libssh packages (libssh-0.12.1-4.hum1) for Red Hat Hardened Images that fix this vulnerability. Users should apply these updates promptly. As a temporary mitigation, disabling the [email protected] and [email protected] ciphers is recommended until patches can be applied. No other mitigation actions are specified by Red Hat.
CVE-2026-59847: Incorrect Check of Function Return Value in Red Hat Red Hat Enterprise Linux 10
Description
A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection.
CVSS v3.1
Score 5.9medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in libssh arises from incorrect checks of the AES-GCM finalization when using the OpenSSL backend, effectively removing integrity protection. This flaw allows an in-path attacker to modify plaintext data on the wire without detection. The issue is tracked as CWE-253 (Incorrect Check of Function Return Value). Red Hat has issued an update for libssh (version 0.12.1-4.hum1) in Red Hat Hardened Images to fix this problem. The CVSS v3.1 base score is 5.9 (medium severity), reflecting a network attack vector with high attack complexity and no privileges or user interaction required. The vulnerability impacts integrity but not confidentiality or availability.
Potential Impact
An attacker positioned in the network path can modify plaintext data transmitted over libssh connections without detection due to the removal of integrity protection caused by incorrect AES-GCM finalization checks. This compromises data integrity but does not affect confidentiality or availability. There are no known exploits in the wild at this time.
Mitigation Recommendations
Red Hat has released updated libssh packages (libssh-0.12.1-4.hum1) for Red Hat Hardened Images that fix this vulnerability. Users should apply these updates promptly. As a temporary mitigation, disabling the [email protected] and [email protected] ciphers is recommended until patches can be applied. No other mitigation actions are specified by Red Hat.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-07-07T15:40:24.561Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-59847","vendor":"Red Hat"}]
Threat ID: 6a5f7ac92a4a8d598939c04e
Added to database: 07/21/2026, 13:57:29 UTC
Last enriched: 08/13/2026, 13:19:42 UTC
Last updated: 09/04/2026, 13:11:59 UTC
Views: 84
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.