Linux · Security advisory · June 12, 2026

ELSA-2026-18683: Security update for 3 packages

ELSA-2026-18683, released June 12, 2026, fixes 10 CVEs across 3 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
10
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0062
49th percentile

Priority of the 10 CVEs

Patch now 0 Urgent 0 High 1 Routine 9

Fixed package versions

ProductReleaseFixed in
libsshol 90:0.10.4-18.el9
libssh-configol 90:0.10.4-18.el9
libssh-develol 90:0.10.4-18.el9

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2026-0966 Libssh: buffer underflow in ssh_get_hexa() on invalid input 8.2 0.0060 None reported
Routine CVE-2025-5351 Libssh: double free vulnerability in libssh key export functions 6.5 0.0062 None reported
Routine CVE-2026-0968 libssh: A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending... 6.5 0.0046 None reported
Routine CVE-2025-8277 Libssh: memory exhaustion via repeated key exchange in libssh 6.5 0.0043 None reported
Routine CVE-2026-0964 Libssh: improper sanitation of paths received from scp servers 6.5 0.0042 None reported
Routine CVE-2025-8114 : null pointer dereference in libssh kex session id calculation 6.5 0.0026 None reported
Routine CVE-2026-0967 Libssh: libssh: denial of service via inefficient regular expression processing 6.5 0.0023 None reported
Routine CVE-2025-4878 Libssh: use of uninitialized variable in privatekey_from_file() 6.5 0.0023 None reported
Routine CVE-2025-4877 Libssh: write beyond bounds in binary to base64 conversion functions 6.5 0.0020 None reported
Routine CVE-2026-0965 Libssh: libssh: denial of service via improper configuration file handling 6.5 0.0016 None reported
Showing 1 to 10 of 10 1