CVE-2026-0967
Medium · 5.5CVSS
5.5
EPSS
0.2%
Published
Mar 26, 2026
CISA due date
—
The record
A flaw was found in libssh. A remote attacker, by controlling client configuration files or known_hosts files, could craft specific hostnames that when processed by the `match_pattern()` function can lead to inefficient regular expression backtracking. This can cause timeouts and resource exhaustion, resulting in a Denial of Service (DoS) for the client.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | libssh | 0 | 0.9.8-150600.11.9.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | libssh | 0 | 0.9.8-3.21.1 |
| openSUSE:Leap 15.6 | libssh | 0 | 0.9.8-150600.11.9.1 |
| openSUSE:Tumbleweed | libssh | 0 | 0.11.4-1.1 |
Related vulnerabilities
- CVE-2026-0968 A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server… Also affects libssh
- CVE-2026-0966 A flaw was found in libssh. Also affects libssh
- CVE-2026-0964 A malicious SCP server can send unexpected paths that could make the client application… Also affects libssh
- CVE-2026-0965 A flaw was found in libssh where it can attempt to open arbitrary files during… Also affects libssh
- CVE-2026-3731 A weakness has been identified in libssh up to 0.11.3. Also affects libssh
- CVE-2015-3146 The (1) SSH_MSG_NEWKEYS and (2) SSH_MSG_KEXDH_REPLY packet handlers in package_cb.c in… Also affects libssh
- CVE-2014-8132 Double free vulnerability in the ssh_packet_kexinit function in kex.c in libssh 0.5.x and… Also affects libssh
- CVE-2026-112901 Pillow is a Python imaging library. CWE-1333