Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw was found in libssh. The API function `ssh_get_hexa()` is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI (Generic Security Service Application Program Interface) authentication if the server's logging verbosity is set to `SSH_LOG_PACKET (3)` or higher. Successful exploitation could lead to a self-Denial of Service of the per-connection daemon process.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
5 versions affected across 4 products
CVE-2026-0966 The API function `ssh_get_hexa()` is vulnerable, when 0-lenght input is provided to this function. This function is used internally in `ssh_get_fingerprint_hash()` and … https://www.cve.org/CVERecord?id=CVE-2026-0966
Post summary
CVE-2026-0966 highlights a vulnerability in the ssh_get_hexa API function triggered by 0‑length input, potentially affecting ssh_get_fingerprint_hash and related operations.
6 of 6 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | libssh | libssh | - | - | - |
| OS | redhat | enterprise_linux | 10.0 | - | - |
| OS | redhat | enterprise_linux | 8.0 | - | - |
| OS | redhat | enterprise_linux | 9.0 | - | - |
| App | redhat | hardened_images | - | - | - |
| App | redhat | openshift_container_platform | 4.0 | - | - |