Linux · Security advisory · August 17, 2026

ELSA-2026-55855: Security update for 3 packages

ELSA-2026-55855, released August 17, 2026, fixes 11 CVEs across 3 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
11
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0057
47th percentile

Priority of the 11 CVEs

Patch now 0 Urgent 0 High 11 Routine 0

Fixed package versions

ProductReleaseFixed in
libsshol 100:0.12.0-3.el10_2
libssh-configol 100:0.12.0-3.el10_2
libssh-develol 100:0.12.0-3.el10_2

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2026-59843 Libssh: libssh: denial of service via zero advertised channel packet size 8.8 0.0057 None reported
High CVE-2026-59844 Libssh: libssh: denial of service via oversized sftp read length 8.8 0.0057 None reported
High CVE-2026-59842 libssh: A flaw was found in libssh 8.8 0.0049 None reported
High CVE-2026-59851 libssh: A flaw was found in libssh 8.8 0.0049 None reported
High CVE-2026-59849 libssh: A flaw was found in libssh 8.8 0.0044 None reported
High CVE-2026-59850 Libssh: libssh: use-after-free via data callbacks on closed channels 8.8 0.0035 None reported
High CVE-2026-59848 Libssh: libssh: denial of service via sftp responses with unknown request ids 8.8 0.0034 None reported
High CVE-2026-59847 Libssh: libssh: integrity downgrade via openssl aes-gcm tag verification 8.8 0.0033 None reported
High CVE-2026-15370 libssh: A flaw was found in libssh 8.8 0.0017 None reported
High CVE-2026-59846 libssh: A flaw was found in libssh 8.8 0.0012 None reported
High CVE-2026-59845 Libssh: libssh: denial of service via unchecked proxycommand fork() failure 8.8 0.0010 None reported
Showing 1 to 11 of 11 1