This vulnerability involves logic errors in libssh's automatic certificate-based public key authentication mechanism. When certificates are missing or repeatedly rejected by the server, libssh clients may loop indefinitely due to an unreachable exit condition in the authentication logic. This infinite loop leads to denial of service by consuming client resources. The issue affects Red Hat Enterprise Linux 10, but no specific affected versions or patch information are detailed in the advisory. The CVSS v3.1 base score is 3.1, reflecting a low severity impact focused on availability with network attack vector, high attack complexity, and low privileges required.

The impact is limited to denial of service on libssh clients due to infinite looping during certificate-based authentication failures. There is no impact on confidentiality or integrity. The vulnerability could cause client applications relying on libssh to become unresponsive or consume excessive resources, potentially disrupting services dependent on SSH connections.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-59849 for current remediation guidance. No official fix or workaround is explicitly stated in the advisory content provided. Users should monitor the vendor advisory for updates and apply any official patches once available.