A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libsshUpgrade libssh-develUpgrade libssh-config | Oct 11, 2026 | Sep 1, 2026 |
| Alpine Linux | — | Upgrade libssh | Jul 29, 2026 | Jul 21, 2026 |
| Amazon_linux_2023 | — | Upgrade libssh-develUpgrade libssh-configUpgrade libssh-debugsourceUpgrade libsshUpgrade libssh-debuginfo | Sep 30, 2026 | Jul 21, 2026 |
| Debian | — | Upgrade libssh | Aug 3, 2026 | Aug 3, 2026 |
| Oracle_linux | — | Upgrade libsshUpgrade libssh-configUpgrade libssh-devel | Oct 22, 2026 | Jul 21, 2026 |
| Redhat_linux | — | Upgrade libssh-debuginfoUpgrade libssh-develUpgrade libsshUpgrade libssh-debugsourceUpgrade libssh-config | Jul 23, 2026 | Jul 21, 2026 |
| Rocky_linux | — | Upgrade libssh-debuginfoUpgrade libssh-debugsourceUpgrade libsshUpgrade libssh-devel | Aug 20, 2026 | Aug 18, 2026 |
| Ubuntu | — | Upgrade libssh-4 | Aug 31, 2026 | Aug 31, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub