CVE-2026-59842

Published: Jul 21, 2026Modified: Aug 19, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length is copied without proper length validation, leading to an out-of-bounds heap read. This could allow a remote unauthenticated attacker to disclose small amounts of server memory.

Affected (3)

Products: Libssh: Libssh · Redhat: Enterprise Linux, Hardened Images

1 product

2 products

Enterprise Linux

Hardened Images

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Libssh Libssh	All versions
Redhat Enterprise Linux	Version 10.0
Redhat Hardened Images	All versions

Related CWEs

Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

References (4)

https://access.redhat.com/errata/RHSA-2026:42922

Source: secalert@redhat.com

Vendor Advisory

https://access.redhat.com/errata/RHSA-2026:55855

Source: secalert@redhat.com

https://access.redhat.com/security/cve/CVE-2026-59842

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2498168

Source: secalert@redhat.com

Issue TrackingVendor Advisory

Timeline

No history available yet.