Veille CVE

Mardi 22 septembre 2026

3 CVE

Critique 0 Élevée 2 Moyenne 1 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Libssh libssh » ✕
  1. CVE-2026-59849 7.5 Élevée

    Red Hat Enterprise Linux 10 · Red Hat Hardened Images · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 9

    A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when configured certificates are missing or repeatedly rejected by a server, leading to denial of service.

  2. CVE-2026-59842 5.3 Moyenne

    Red Hat Enterprise Linux 10 · Red Hat Hardened Images · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 9

    A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length is copied without proper length validation, leading to an out-of-bounds heap read. This could allow a remote unauthenticated attacker to disclose small amounts of server memory.

  3. CVE-2026-15370 7.3 Élevée

    Red Hat Enterprise Linux 10 · Red Hat Hardened Images · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 9

    A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list attacker-controlled filenames, sufficiently long names can overflow that stack buffer and may lead to crashes or possible code execution on the server.