CVE-2026-59842: libssh Information Disclosure Vulnerability

CVE-2026-59842 Overview

CVE-2026-59842 is an out-of-bounds heap read vulnerability in libssh, a widely used C library that implements the Secure Shell (SSH) protocol. The flaw resides in the server-side Generic Security Services Application Program Interface (GSSAPI) key exchange path. When a client supplies a Curve25519 public key shorter than the expected 32 bytes, libssh copies the value without validating its length. This produces an out-of-bounds read from adjacent heap memory. A remote, unauthenticated attacker can trigger the condition and disclose small amounts of server memory during the key exchange handshake.

Critical Impact
A remote unauthenticated attacker can read small fragments of server heap memory by sending a malformed Curve25519 public key during GSSAPI key exchange.

Affected Products

libssh server implementations with GSSAPI key exchange enabled
Red Hat Enterprise Linux packages shipping affected libssh builds (see Red Hat Security Errata RHSA-2026:42922)
Downstream applications and appliances linking against vulnerable libssh versions

Discovery Timeline

2026-07-21 - CVE-2026-59842 published to the National Vulnerability Database (NVD)
2026-07-22 - Record last modified in NVD

Technical Details for CVE-2026-59842

Vulnerability Analysis

The vulnerability is classified under [CWE-125: Out-of-Bounds Read]. It occurs in the server-side handler for GSSAPI key exchange (gssapi-with-mic variants using Curve25519). The Curve25519 primitive expects a fixed 32-byte public key. When the client sends a shorter buffer, the server copies the attacker-controlled length into a fixed-size structure without validating the source length. Subsequent cryptographic processing then reads beyond the supplied bytes into adjacent heap memory. Because the read spans a small region, information disclosure is limited to a few bytes per handshake, but the operation is repeatable and requires no authentication.

Root Cause

The root cause is missing length validation on the client-supplied Curve25519 public key before it is consumed by the key exchange routine. The code assumes the key blob is exactly 32 bytes and does not enforce the constraint prior to memory copy and scalar multiplication. This assumption breaks when a malformed handshake supplies a truncated field.

Attack Vector

The attack vector is network-based and pre-authentication. An attacker initiates an SSH connection to a server that advertises GSSAPI key exchange, negotiates a Curve25519-based gss-* method, and transmits a KEXGSS packet containing a short q_c public key. Attack complexity is high because the attacker must reach a service that both exposes GSSAPI key exchange and reveals leaked bytes through observable protocol behavior. The confidentiality impact is low, with no integrity or availability effects.

No verified public proof-of-concept code is available. See the Red Hat CVE record and Red Hat Bug Report #2498168 for the upstream technical description.

Detection Methods for CVE-2026-59842

Indicators of Compromise

Repeated inbound SSH connections that negotiate GSSAPI key exchange methods such as gss-curve25519-sha256- followed by immediate disconnects.
SSH server logs showing malformed KEXGSS_INIT messages or key exchange failures tied to Curve25519 parameter length errors.
Unusual volumes of pre-authentication SSH sessions from a small set of source addresses targeting hosts with Kerberos or GSSAPI enabled.

Detection Strategies

Enable verbose logging on SSH daemons using libssh and alert on repeated key exchange failures during the GSSAPI handshake stage.
Inspect network telemetry for SSH sessions that terminate immediately after SSH_MSG_KEXGSS_INIT without proceeding to authentication.
Correlate SSH handshake anomalies with source reputation to prioritize unauthenticated scanners probing GSSAPI-enabled hosts.

Monitoring Recommendations

Inventory hosts and appliances that link against libssh and expose SSH with GSSAPI key exchange enabled.
Track package versions of libssh across the fleet and flag any host not aligned with the vendor-patched build.
Monitor for exploitation attempts against public-facing SSH services where GSSAPI is not required for business operations.

How to Mitigate CVE-2026-59842

Immediate Actions Required

Apply the vendor-supplied libssh update referenced in RHSA-2026:42922 or the equivalent package from your distribution.
Restart all services that link against libssh after patching so the updated library is loaded into memory.
Disable GSSAPI key exchange on SSH servers that do not require Kerberos-based authentication.

Patch Information

Red Hat has published fixed libssh packages through RHSA-2026:42922. The patched code enforces a strict 32-byte length check on the client-supplied Curve25519 public key before it is copied and used in scalar multiplication. Downstream vendors that ship libssh should pick up the upstream fix and rebuild dependent packages. Consult the Red Hat CVE record for CVE-2026-59842 for the current list of affected components.

Workarounds

Set GSSAPIKeyExchange no and disable Kerberos-related SSH options on servers where GSSAPI is not needed.
Restrict inbound SSH access to trusted management networks using firewall rules or bastion hosts.
Remove gss-* methods from the server's configured key exchange algorithm list until patched builds are deployed.

bash

# Example: disable GSSAPI key exchange on an OpenSSH-based server
# /etc/ssh/sshd_config
GSSAPIAuthentication no
GSSAPIKeyExchange no
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256

# Reload the service after changes
sudo systemctl reload sshd