CVE-2026-0967: libssh Denial of Service Vulnerability

CVE-2026-0967 Overview

A flaw was found in libssh that allows a remote attacker to cause a Denial of Service (DoS) condition through inefficient regular expression backtracking. By controlling client configuration files or known_hosts files, an attacker can craft specific hostnames that, when processed by the match_pattern() function, trigger excessive backtracking in the pattern matching logic. This can lead to timeouts and resource exhaustion, effectively denying service to SSH clients.

Critical Impact

Attackers with control over client configuration files can craft malicious hostnames that cause resource exhaustion and service denial through inefficient regex processing in the libssh match_pattern() function.

Affected Products

• libssh versions prior to 0.12.0
• libssh versions prior to 0.11.4
• Applications and systems using vulnerable libssh library versions

Discovery Timeline

• 2026-02-10 - libssh security releases 0.12.0 and 0.11.4 announced
• 2026-03-26 - CVE-2026-0967 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-0967

Vulnerability Analysis

This vulnerability (CWE-1333: Inefficient Regular Expression Complexity) affects the match_pattern() function within libssh. The function is responsible for matching hostnames against patterns in SSH configuration files and known_hosts files. The underlying issue is that certain crafted hostname patterns can trigger catastrophic backtracking in the regular expression engine, leading to exponential time complexity during pattern matching operations.

The vulnerability requires local access and user interaction, as an attacker must first gain the ability to modify client configuration files or known_hosts files. Once these files contain malicious hostname patterns, subsequent SSH operations that invoke the match_pattern() function will experience severe performance degradation or complete timeouts.

Root Cause

The root cause lies in the regular expression handling within the match_pattern() function. The pattern matching algorithm does not adequately protect against pathological input patterns that cause excessive backtracking. When processing hostnames with specific character sequences, the regex engine may enter a state where it repeatedly attempts alternative matching paths, consuming CPU resources exponentially relative to input length.

This is a classic example of Regular Expression Denial of Service (ReDoS), where the computational complexity of pattern matching grows non-linearly with specially crafted input strings.

Attack Vector

The attack requires local access to the target system to modify SSH client configuration files (such as ~/.ssh/config or ~/.ssh/known_hosts). An attacker who has already compromised a user account or gained write access to these files can insert malicious hostname patterns.

When the SSH client subsequently attempts to connect to any host, the match_pattern() function processes these configuration entries. If a crafted malicious pattern is present, the function enters inefficient backtracking loops, causing the client to hang or timeout. This effectively denies SSH service to the user without requiring network-based exploitation.

The attack scenario involves crafting hostname patterns with nested wildcards or repetitive character sequences that exploit weaknesses in the regex implementation. For detailed technical information, refer to the Red Hat Bugzilla Bug Report and the libssh Security Release Announcement.

Detection Methods for CVE-2026-0967

Indicators of Compromise

• Unusual CPU spikes on systems running SSH clients
• SSH client operations timing out or hanging indefinitely
• Modified known_hosts or SSH config files with unusual hostname patterns containing repetitive or nested wildcard characters
• User reports of SSH connection failures without network connectivity issues

Detection Strategies

• Monitor for unauthorized modifications to SSH configuration files (~/.ssh/config, ~/.ssh/known_hosts, /etc/ssh/ssh_config)
• Implement file integrity monitoring (FIM) on SSH configuration directories
• Detect anomalous CPU usage patterns associated with SSH client processes
• Review SSH configuration files for suspicious hostname patterns with excessive wildcards or special characters

Monitoring Recommendations

• Enable audit logging for file access to SSH configuration directories
• Configure alerts for SSH client processes consuming excessive CPU time
• Implement periodic automated scanning of SSH configuration files for malformed or suspicious patterns
• Monitor system logs for SSH client timeout errors or performance degradation indicators

How to Mitigate CVE-2026-0967

Immediate Actions Required

• Update libssh to version 0.12.0 or 0.11.4 or later immediately
• Audit SSH configuration files (~/.ssh/config, ~/.ssh/known_hosts) for unusual or suspicious hostname patterns
• Restrict write permissions on SSH configuration directories to prevent unauthorized modification
• Review recent changes to SSH configuration files using version control or file integrity monitoring data

Patch Information

The libssh project has released security updates addressing this vulnerability. Users should upgrade to libssh version 0.12.0 or 0.11.4, which contain fixes for the inefficient regular expression handling in the match_pattern() function. These versions are available from the official libssh Security Release Announcement.

For Red Hat-based distributions, refer to the Red Hat CVE-2026-0967 Advisory for distribution-specific patch information and update instructions.

Workarounds

• Implement strict file permissions (600) on all SSH configuration files to prevent unauthorized modification
• Use file integrity monitoring tools to detect and alert on configuration file changes
• Consider using SELinux or AppArmor policies to restrict write access to SSH configuration directories
• Regularly audit and validate the contents of known_hosts and SSH config files for anomalous entries

# Configuration example
# Secure SSH configuration file permissions
chmod 600 ~/.ssh/config
chmod 600 ~/.ssh/known_hosts
chmod 700 ~/.ssh

# Verify current libssh version (method varies by system)
ssh -V

# For systems using package managers, check libssh version
rpm -q libssh    # RHEL/CentOS/Fedora
dpkg -l libssh*  # Debian/Ubuntu