apk package
chainguard/libssh-dev
pkg:apk/chainguard/libssh-dev
Vulnerabilities (19)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-59851 | Hig | 8.8 | < 0.12.1-r0 | 0.12.1-r0 | Jul 21, 2026 | A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users. | |
| CVE-2026-59850 | Med | 4.3 | < 0.12.1-r0 | 0.12.1-r0 | Jul 21, 2026 | A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions. | |
| CVE-2026-59849 | Low | 3.1 | < 0.12.1-r0 | 0.12.1-r0 | Jul 21, 2026 | A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when configured certificates are missing or repeatedly rejected by a server, leading to denial of service. | |
| CVE-2026-59848 | Med | 5.3 | < 0.12.1-r0 | 0.12.1-r0 | Jul 21, 2026 | A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service. | |
| CVE-2026-59847 | Med | 5.9 | < 0.12.1-r0 | 0.12.1-r0 | Jul 21, 2026 | A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection. | |
| CVE-2026-59846 | Low | 3.9 | < 0.12.1-r0 | 0.12.1-r0 | Jul 21, 2026 | A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior. | |
| CVE-2026-59845 | Med | 5.3 | < 0.12.1-r0 | 0.12.1-r0 | Jul 21, 2026 | A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service. | |
| CVE-2026-59844 | Med | 6.5 | < 0.12.1-r0 | 0.12.1-r0 | Jul 21, 2026 | A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests. | |
| CVE-2026-59843 | Med | 6.5 | < 0.12.2-r0 | 0.12.2-r0 | Jul 21, 2026 | A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later channel writes to loop indefinitely and consume CPU, leading to denial of service. | |
| CVE-2026-59842 | Low | 3.7 | < 0.12.1-r0 | 0.12.1-r0 | Jul 21, 2026 | A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length is copied without proper length validation, leading to an out-of-bounds heap read. This could allow a remote unauthenticated attacker to di | |
| CVE-2026-15370 | Med | 6.7 | < 0.12.1-r0 | 0.12.1-r0 | Jul 21, 2026 | A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list attacker-controlled filenames, sufficiently long names can overflow that stack buf | |
| CVE-2025-14821 | Hig | 7.8 | < 0.12.0-r2 | 0.12.0-r2 | Apr 7, 2026 | A flaw was found in libssh. This vulnerability allows local man-in-the-middle attacks, security downgrades of SSH (Secure Shell) connections, and manipulation of trusted host information, posing a significant risk to the confidentiality, integrity, and availability of SSH communi | |
| CVE-2025-8114 | Med | 4.7 | < 0.11.3-r0 | 0.11.3-r0 | Jul 24, 2025 | A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange (KEX) process, an allocation failure in cryptographic functions may lead to a NULL pointer dereference. This issue can cause the client or server to cra | |
| CVE-2025-5987 | Hig | 8.1 | < 0.11.3-r0 | 0.11.3-r0 | Jul 7, 2025 | A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized cipher context. This occurs because the OpenSSL error code returne | |
| CVE-2025-5318 | Med | 5.4 | < 0.11.3-r0 | 0.11.3-r0 | Jun 24, 2025 | A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in the sftp_handle function due to an incorrect comparison check that permits the function to access memory beyond the valid handle list and to return an invalid pointer, w | |
| CVE-2023-6004 | Med | 4.8 | < 0.10.6-r0 | 0.10.6-r0 | Jan 3, 2024 | A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter. | |
| CVE-2023-6918 | Low | 3.7 | < 0.10.6-r0 | 0.10.6-r0 | Dec 19, 2023 | A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or | |
| CVE-2023-48795 | Med | 5.9 | < 0.10.6-r0 | 0.10.6-r0 | Dec 18, 2023 | The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end | |
| CVE-2023-3603 | Low | 3.1 | < 0 | 0 | Jul 21, 2023 | A missing allocation check in sftp server processing read requests may cause a NULL dereference on low-memory conditions. The malicious client can request up to 4GB SFTP reads, causing allocation of up to 4GB buffers, which was not being checked for failure. This will likely cras |
- affected < 0.12.1-r0fixed 0.12.1-r0
A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.
- affected < 0.12.1-r0fixed 0.12.1-r0
A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions.
- affected < 0.12.1-r0fixed 0.12.1-r0
A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when configured certificates are missing or repeatedly rejected by a server, leading to denial of service.
- affected < 0.12.1-r0fixed 0.12.1-r0
A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service.
- affected < 0.12.1-r0fixed 0.12.1-r0
A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection.
- affected < 0.12.1-r0fixed 0.12.1-r0
A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.
- affected < 0.12.1-r0fixed 0.12.1-r0
A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service.
- affected < 0.12.1-r0fixed 0.12.1-r0
A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests.
- affected < 0.12.2-r0fixed 0.12.2-r0
A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later channel writes to loop indefinitely and consume CPU, leading to denial of service.
- affected < 0.12.1-r0fixed 0.12.1-r0
A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length is copied without proper length validation, leading to an out-of-bounds heap read. This could allow a remote unauthenticated attacker to di
- affected < 0.12.1-r0fixed 0.12.1-r0
A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list attacker-controlled filenames, sufficiently long names can overflow that stack buf
- affected < 0.12.0-r2fixed 0.12.0-r2
A flaw was found in libssh. This vulnerability allows local man-in-the-middle attacks, security downgrades of SSH (Secure Shell) connections, and manipulation of trusted host information, posing a significant risk to the confidentiality, integrity, and availability of SSH communi
- affected < 0.11.3-r0fixed 0.11.3-r0
A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange (KEX) process, an allocation failure in cryptographic functions may lead to a NULL pointer dereference. This issue can cause the client or server to cra
- affected < 0.11.3-r0fixed 0.11.3-r0
A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized cipher context. This occurs because the OpenSSL error code returne
- affected < 0.11.3-r0fixed 0.11.3-r0
A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in the sftp_handle function due to an incorrect comparison check that permits the function to access memory beyond the valid handle list and to return an invalid pointer, w
- affected < 0.10.6-r0fixed 0.10.6-r0
A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter.
- affected < 0.10.6-r0fixed 0.10.6-r0
A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or
- affected < 0.10.6-r0fixed 0.10.6-r0
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end
- affected < 0fixed 0
A missing allocation check in sftp server processing read requests may cause a NULL dereference on low-memory conditions. The malicious client can request up to 4GB SFTP reads, causing allocation of up to 4GB buffers, which was not being checked for failure. This will likely cras