Medium severity6.3NVD Advisory· Published Mar 26, 2026· Updated May 19, 2026
CVE-2026-0964
CVE-2026-0964
Description
A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory. This could be misused to create malicious executable or configuration files and make the user execute them under specific consequences.
This is the same issue as in OpenSSH, tracked as CVE-2019-6111.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
20- cpe:2.3:a:redhat:hardened_images:-:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
- osv-coords13 versionspkg:rpm/almalinux/libsshpkg:rpm/almalinux/libssh-configpkg:rpm/almalinux/libssh-develpkg:rpm/opensuse/libssh&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/libssh&distro=openSUSE%20Tumbleweedpkg:rpm/suse/libssh&distro=SUSE%20Linux%20Enterprise%20Micro%205.2pkg:rpm/suse/libssh&distro=SUSE%20Linux%20Enterprise%20Micro%205.3pkg:rpm/suse/libssh&distro=SUSE%20Linux%20Enterprise%20Micro%205.4pkg:rpm/suse/libssh&distro=SUSE%20Linux%20Enterprise%20Micro%205.5pkg:rpm/suse/libssh&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7pkg:rpm/suse/libssh&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5pkg:rpm/suse/libssh&distro=SUSE%20Linux%20Micro%206.0pkg:rpm/suse/libssh&distro=SUSE%20Linux%20Micro%206.1
< 0.12.0-2.el10+ 12 more
- (no CPE)range: < 0.12.0-2.el10
- (no CPE)range: < 0.12.0-2.el10
- (no CPE)range: < 0.12.0-2.el10
- (no CPE)range: < 0.9.8-150600.11.9.1
- (no CPE)range: < 0.11.4-1.1
- (no CPE)range: < 0.9.8-150200.13.15.1
- (no CPE)range: < 0.9.8-150400.3.17.1
- (no CPE)range: < 0.9.8-150400.3.17.1
- (no CPE)range: < 0.9.8-150400.3.17.1
- (no CPE)range: < 0.9.8-150600.11.9.1
- (no CPE)range: < 0.9.8-3.21.1
- (no CPE)range: < 0.10.6-4.1
- (no CPE)range: < 0.10.6-slfo.1.1_4.1
Patches
Vulnerability mechanics
References
5- access.redhat.com/security/cve/CVE-2026-0964nvdMitigationVendor Advisory
- bugzilla.redhat.com/show_bug.cginvdIssue TrackingVendor Advisory
- www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/nvdRelease Notes
- access.redhat.com/errata/RHSA-2026:18160nvd
- access.redhat.com/errata/RHSA-2026:18683nvd
News mentions
0No linked articles in our index yet.