CVE-2026-0965
Low · 3.3CVSS
3.3
EPSS
0.2%
Published
Mar 26, 2026
CISA due date
—
The record
A flaw was found in libssh where it can attempt to open arbitrary files during configuration parsing. A local attacker can exploit this by providing a malicious configuration file or when the system is misconfigured. This vulnerability could lead to a Denial of Service (DoS) by causing the system to try and access dangerous files, such as block devices or large system files, which can disrupt normal operations.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | libssh | 0 | 0.9.8-150600.11.9.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | libssh | 0 | 0.9.8-3.21.1 |
| openSUSE:Leap 15.6 | libssh | 0 | 0.9.8-150600.11.9.1 |
| openSUSE:Tumbleweed | libssh | 0 | 0.11.4-1.1 |
Related vulnerabilities
- CVE-2026-0968 A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server… Also affects libssh
- CVE-2026-0967 A flaw was found in libssh. Also affects libssh
- CVE-2026-0966 A flaw was found in libssh. Also affects libssh
- CVE-2026-0964 A malicious SCP server can send unexpected paths that could make the client application… Also affects libssh
- CVE-2026-3731 A weakness has been identified in libssh up to 0.11.3. Also affects libssh
- CVE-2015-3146 The (1) SSH_MSG_NEWKEYS and (2) SSH_MSG_KEXDH_REPLY packet handlers in package_cb.c in… Also affects libssh
- CVE-2014-8132 Double free vulnerability in the ssh_packet_kexinit function in kex.c in libssh 0.5.x and… Also affects libssh
- CVE-2026-88899 knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request… CWE-73