Linux · Security advisory · August 18, 2026
RLSA-2026:55855: libssh security update
RLSA-2026:55855, released August 18, 2026, fixes 11 CVEs in libssh (version 0:0.12.0-3.el10_2). None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
11
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0057
47th percentile
Priority of the 11 CVEs
Patch now 0
Urgent 0
High 11
Routine 0
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| libssh | rocky 10 | 0:0.12.0-3.el10_2 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| High | CVE-2026-59843 | Libssh: libssh: denial of service via zero advertised channel packet size | 8.8 | 0.0057 | None reported | |
| High | CVE-2026-59844 | Libssh: libssh: denial of service via oversized sftp read length | 8.8 | 0.0057 | None reported | |
| High | CVE-2026-59842 | libssh: A flaw was found in libssh | 8.8 | 0.0049 | None reported | |
| High | CVE-2026-59851 | libssh: A flaw was found in libssh | 8.8 | 0.0049 | None reported | |
| High | CVE-2026-59849 | libssh: A flaw was found in libssh | 8.8 | 0.0044 | None reported | |
| High | CVE-2026-59850 | Libssh: libssh: use-after-free via data callbacks on closed channels | 8.8 | 0.0035 | None reported | |
| High | CVE-2026-59848 | Libssh: libssh: denial of service via sftp responses with unknown request ids | 8.8 | 0.0034 | None reported | |
| High | CVE-2026-59847 | Libssh: libssh: integrity downgrade via openssl aes-gcm tag verification | 8.8 | 0.0033 | None reported | |
| High | CVE-2026-15370 | libssh: A flaw was found in libssh | 8.8 | 0.0017 | None reported | |
| High | CVE-2026-59846 | libssh: A flaw was found in libssh | 8.8 | 0.0012 | None reported | |
| High | CVE-2026-59845 | Libssh: libssh: denial of service via unchecked proxycommand fork() failure | 8.8 | 0.0010 | None reported |
Showing 1 to 11 of 11
1