CVE-2026-0965: libssh Configuration Parsing DoS Vulnerability

CVE-2026-0965 Overview

A flaw was found in libssh where it can attempt to open arbitrary files during configuration parsing. A local attacker can exploit this by providing a malicious configuration file or when the system is misconfigured. This vulnerability could lead to a Denial of Service (DoS) by causing the system to try and access dangerous files, such as block devices or large system files, which can disrupt normal operations.

Critical Impact

Local attackers can cause Denial of Service by forcing libssh to access dangerous files like block devices or large system files during configuration parsing.

Affected Products

• libssh (all versions using configuration file parsing)

Discovery Timeline

• 2026-03-26 - CVE CVE-2026-0965 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-0965

Vulnerability Analysis

This vulnerability is classified under CWE-73 (External Control of File Name or Path), which occurs when software allows user input to control or influence file paths used in operations. In the case of libssh, the configuration parsing mechanism fails to properly validate or restrict file paths, allowing attackers to specify arbitrary files for the library to access.

The local attack vector requires an attacker to have some level of access to the system to either supply a malicious configuration file or exploit an existing misconfiguration. While the vulnerability does not lead to information disclosure or integrity violations, it can cause availability issues when libssh attempts to access problematic files.

Root Cause

The root cause lies in libssh's configuration file parsing implementation, which does not adequately sanitize or validate file paths specified within configuration directives. This allows external control over file path operations, enabling attackers to direct the library to attempt access to files that may cause system disruption.

The vulnerability manifests when libssh processes configuration files that contain references to arbitrary file system paths. Without proper path validation, the library will attempt to open and read files such as:

• Block devices (e.g., /dev/sda)
• Large system files that could exhaust memory
• Special files that may block or hang operations
• Named pipes or FIFOs that could cause indefinite waits

Attack Vector

This is a local attack vector vulnerability requiring the attacker to have the ability to either:

1. Supply a malicious configuration file - An attacker with write access to configuration file locations or the ability to influence which configuration file libssh loads can craft a configuration containing paths to dangerous files.

2. Exploit system misconfiguration - In environments where configuration paths are not properly secured, an attacker may be able to modify existing configuration files to include malicious file references.

When libssh processes the malicious configuration, it attempts to access the specified files, potentially causing the application to hang, consume excessive resources, or crash—resulting in a Denial of Service condition.

Detection Methods for CVE-2026-0965

Indicators of Compromise

• Unexpected file access attempts by processes using libssh to block devices or large system files
• Unusual configuration file modifications in libssh configuration directories
• Application crashes or hangs during SSH operations related to configuration parsing
• Increased resource consumption by libssh-dependent applications

Detection Strategies

• Monitor file access patterns for libssh processes, alerting on attempts to access block devices or /dev/ paths
• Implement file integrity monitoring on libssh configuration files to detect unauthorized modifications
• Configure audit logging for file operations performed by applications using libssh
• Deploy endpoint detection solutions to identify anomalous file access patterns during SSH operations

Monitoring Recommendations

• Enable system auditing for file access events on sensitive system files and block devices
• Implement centralized logging for applications using libssh to correlate configuration changes with operational issues
• Set up alerts for repeated or failed file access attempts from SSH-related processes
• Monitor application health metrics for libssh-dependent services to detect DoS conditions early

How to Mitigate CVE-2026-0965

Immediate Actions Required

• Review and secure file permissions on all libssh configuration files to prevent unauthorized modification
• Ensure configuration directories are only writable by trusted administrators
• Audit existing libssh configuration files for suspicious or unexpected file path references
• Consider implementing application-level restrictions on configuration file locations

Patch Information

Consult the Red Hat CVE-2026-0965 Advisory for the latest patch information and affected versions. Additional technical details are available in Red Hat Bugzilla Report #2436980.

Monitor vendor security channels for updated libssh packages that address this configuration parsing vulnerability.

Workarounds

• Restrict write access to libssh configuration files and directories to only trusted system administrators
• Implement mandatory access control (MAC) policies using SELinux or AppArmor to limit file access scope for libssh processes
• Use configuration management tools to enforce known-good configuration states and detect unauthorized changes
• Consider running libssh-dependent applications in containerized or sandboxed environments to limit file system exposure

# Configuration example - Secure libssh configuration directory permissions
chmod 755 /etc/ssh
chmod 644 /etc/ssh/ssh_config
chown root:root /etc/ssh/ssh_config

# Enable SELinux enforcement for SSH operations
setenforce 1
setsebool -P ssh_sysadm_login off