This Red Hat security advisory (RHSA-2026:42922) addresses multiple vulnerabilities in libssh RPM packages included in Red Hat Hardened Images. Among these, CVE-2026-59849 describes a denial of service caused by an infinite loop in libssh's automatic certificate-based public key authentication logic when certificates are missing or repeatedly rejected by the server. This leads to resource exhaustion such as CPU and memory consumption. The advisory lists updated libssh RPMs (version 0.12.1-4.hum1) for aarch64 and x86_64 architectures. The advisory does not explicitly confirm patch availability but provides updated package versions and instructions to apply the update via https://images.redhat.com/. The advisory also notes that Red Hat scores and impact ratings may differ from other sources due to vendor-specific factors. No known exploits in the wild are reported.

The primary impact is denial of service due to an infinite loop in libssh clients during automatic certificate authentication, causing resource exhaustion (CPU and memory). This can degrade or halt the operation of affected systems using vulnerable libssh versions. No confidentiality or integrity impacts are reported. The advisory covers multiple CVEs, but detailed impact information is provided mainly for CVE-2026-59849. No active exploitation is known.

Red Hat provides updated libssh RPM packages (version 0.12.1-4.hum1) as a bug fix and enhancement update. Users should apply these updated packages to remediate the vulnerabilities. Until patched, it is recommended to avoid connecting to untrusted SSH servers and not to use certificate-based authentication to prevent denial of service. Check the vendor advisory at https://images.redhat.com/ for detailed update instructions. Patch status is effectively confirmed by the availability of updated RPMs in the advisory.