Description
The API function `ssh_get_hexa()` is vulnerable, when 0-lenght input is provided to this function. This function is used internally in `ssh_get_fingerprint_hash()` and `ssh_print_hexa()` (deprecated), which is vulnerable to the same input (length is provided by the calling application). The function is also used internally in the gssapi code for logging the OIDs received by the server during GSSAPI authentication. This could be triggered remotely, when the server allows GSSAPI authentication and logging verbosity is set at least to SSH_LOG_PACKET (3). This could cause self-DoS of the per-connection daemon process.
INFO
Published Date :
2026-03-26T20:06:28.313Z
Last Modified :
2026-05-07T14:06:57.267Z
Source :
redhat
AFFECTED PRODUCTS
The following products are affected by CVE-2026-0966 vulnerability.
| Vendors | Products |
|---|---|
| Libssh |
|
| Redhat |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-0966.
