A vulnerability in libssh allows a remote unauthenticated attacker to cause an out-of-bounds heap read during server-side GSSAPI key exchange by supplying a Curve25519 public key shorter than expected. This flaw can lead to disclosure of small amounts of server memory. The issue is tracked as CVE-2026-59842 and has a low severity rating with a CVSS score of 3.7. Red Hat has released updates for libssh packages to address this vulnerability. Mitigations include disabling GSSAPIKeyExchange or removing the gss-curve25519-sha256- algorithm from GSSAPIKexAlgorithms if appropriate.