# RHSA-2026:18683: Security update for 3 packages

RHSA-2026:18683, released May 27, 2026, fixes 10 CVEs across 3 products. None of them is reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/fix/linux/rhsa-2026-18683
- Platform: Linux
- Released: May 27, 2026
- Priority: High (Closes CVE-2026-0966, high severity)
- CVEs: 10, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://access.redhat.com/errata/RHSA-2026:18683

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [libssh](https://patchblox.com/security/data/product/linux/libssh.md) | RHEL 9 | 0:0.10.4-18.el9 |
| [libssh-config](https://patchblox.com/security/data/product/linux/libssh-config.md) | RHEL 9 | 0:0.10.4-18.el9 |
| [libssh-devel](https://patchblox.com/security/data/product/linux/libssh-devel.md) | RHEL 9 | 0:0.10.4-18.el9 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-0966](https://patchblox.com/security/data/cve/CVE-2026-0966.md) | High | Libssh: buffer underflow in ssh_get_hexa() on invalid input | 8.2 | 0.0060 |  |
| [CVE-2025-5351](https://patchblox.com/security/data/cve/CVE-2025-5351.md) | Routine | Libssh: double free vulnerability in libssh key export functions | 6.5 | 0.0062 |  |
| [CVE-2026-0968](https://patchblox.com/security/data/cve/CVE-2026-0968.md) | Routine | libssh: A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending... | 6.5 | 0.0046 |  |
| [CVE-2025-8277](https://patchblox.com/security/data/cve/CVE-2025-8277.md) | Routine | Libssh: memory exhaustion via repeated key exchange in libssh | 6.5 | 0.0043 |  |
| [CVE-2026-0964](https://patchblox.com/security/data/cve/CVE-2026-0964.md) | Routine | Libssh: improper sanitation of paths received from scp servers | 6.5 | 0.0042 |  |
| [CVE-2025-8114](https://patchblox.com/security/data/cve/CVE-2025-8114.md) | Routine | : null pointer dereference in libssh kex session id calculation | 6.5 | 0.0026 |  |
| [CVE-2026-0967](https://patchblox.com/security/data/cve/CVE-2026-0967.md) | Routine | Libssh: libssh: denial of service via inefficient regular expression processing | 6.5 | 0.0023 |  |
| [CVE-2025-4878](https://patchblox.com/security/data/cve/CVE-2025-4878.md) | Routine | Libssh: use of uninitialized variable in privatekey_from_file() | 6.5 | 0.0023 |  |
| [CVE-2025-4877](https://patchblox.com/security/data/cve/CVE-2025-4877.md) | Routine | Libssh: write beyond bounds in binary to base64 conversion functions | 6.5 | 0.0020 |  |
| [CVE-2026-0965](https://patchblox.com/security/data/cve/CVE-2026-0965.md) | Routine | Libssh: libssh: denial of service via improper configuration file handling | 6.5 | 0.0016 |  |

---

Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo