Libssh: Eleven Vulnerabilities Disclosed Together, Including Auth Bypass and DoS
Libssh: Eleven vulnerabilities, including an authentication bypass and multiple DoS flaws, were disclosed in a single batch on July 21, 2026.
Key findings
- Eleven vulnerabilities in Libssh disclosed together on July 21, 2026, spanning 5 hours.
- CVE-2026-59851: An important severity authentication bypass via missing GSSAPI principal check.
- Multiple denial of service vulnerabilities affect SFTP, certificate authentication, and ProxyCommand handling.
- Other issues include use-after-free, integrity downgrade, and information disclosure flaws.
- The batch covers a wide range of security risks within the Libssh library.
On July 21, 2026, a batch of eleven vulnerabilities was disclosed for the Libssh library, with a disclosure window spanning just five hours. The vulnerabilities, ranging in severity from low to important, were reported together, highlighting potential weaknesses in various aspects of the SSH protocol implementation. The most critical of these, CVE-2026-59851, is an authentication bypass flaw stemming from a missing GSSAPI principal check, carrying a CVSSv3 score of 8.8.
Several vulnerabilities focus on denial of service (DoS) conditions. CVE-2026-59849 and CVE-2026-59843 describe DoS risks through automatic certificate authentication loops and zero advertised channel packet sizes, respectively. CVE-2026-59848 and CVE-2026-59844 detail DoS vulnerabilities related to SFTP responses with unknown request IDs and oversized SFTP read lengths, both rated as moderate severity. Additionally, CVE-2026-59845 points to a DoS vulnerability due to an unchecked ProxyCommand fork() failure.
Other security concerns include information disclosure and integrity issues. CVE-2026-59846 details an information disclosure vulnerability via ProxyCommand %r username expansion, while CVE-2026-59842 involves information disclosure through a short GSSAPI Curve25519 public key. CVE-2026-59847 addresses an integrity downgrade risk via OpenSSL AES-GCM tag verification. A use-after-free vulnerability in data callbacks on closed channels, CVE-2026-59850, also presents a moderate risk. Finally, CVE-2026-15370 is a moderate severity stack buffer overflow in the SFTP server's longname construction.
The coordinated disclosure of these eleven CVEs underscores the importance of regular security audits and timely patching for widely used libraries like Libssh. Users are advised to review the specific details of each vulnerability and apply any available updates or mitigations provided by the Libssh maintainers to protect against potential exploitation. The broad range of issues, from authentication bypass to denial of service and information disclosure, indicates a need for comprehensive security practices when integrating and managing SSH client libraries.