CVE-2026-59847
EUVD-2026-4625521.07.2026, 14:16
A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| libssh | libssh | 0.9.0 ≤ 𝑥 < 0.11.5 |
| libssh | libssh | 0.12.0 |
| redhat | hardened_images | - |
| redhat | enterprise_linux | 8.0 |
| redhat | enterprise_linux | 9.0 |
| redhat | enterprise_linux | 10.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
openSUSE / SLES Releases
openSUSE Product | |||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| libssh-config |
| ||||||||||||||||||||||
| libssh-devel |
| ||||||||||||||||||||||
| libssh4 |
| ||||||||||||||||||||||
| libssh4-32bit |
|
Common Weakness Enumeration
- CWE-253 - Incorrect Check of Function Return ValueThe software incorrectly checks a return value from a function, which prevents the software from detecting errors or exceptional conditions.
- CWE-1310 - Missing Ability to Patch ROM CodeMissing an ability to patch ROM code may leave a System or System-on-Chip (SoC) in a vulnerable state.
References