CVE-2026-0965CWE-73

CVE-2026-0965

Low · published March 27, 2026

CVSS v3.0
3.3
EPSS
0%
Percentile
4.5
In the wild
Unconfirmed
What it is

A flaw was found in libssh where it can attempt to open arbitrary files during configuration parsing. A local attacker can exploit this by providing a malicious configuration file or when the system is misconfigured. This vulnerability could lead to a Denial of Service (DoS) by causing the system to try and access dangerous files, such as block devices or large system files, which can disrupt normal operations.

The record
Technical detail
CVSS v3.0
3.3 · LOW
Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00158 · 4.5th percentile
Weakness
CWE-73 · External Control of File Name or Path
Published
2026-03-27T01:17Z
Affected products (3)
ProductVersionsFixed in
libssh/libssh≤ 0.11.3—
redhat/enterprise_linuxall versions—
redhat/enterprise_linuxall versions—
References (4)
https://access.redhat.com/errata/RHSA-2026:18160 · [email protected]https://access.redhat.com/errata/RHSA-2026:18683 · [email protected]https://access.redhat.com/security/cve/CVE-2026-0965 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2436980 · [email protected]
EPSS history
Timeline
  • 26 MAR 20:06Z
    Libssh: libssh: denial of service via improper configuration file handling
    cvelistv5