CVE-2026-59845: libssh ProxyCommand DoS Vulnerability

CVE-2026-59845 Overview

CVE-2026-59845 is a local denial-of-service vulnerability in libssh triggered when the ProxyCommand feature is used. An unchecked fork() failure allows the process ID to be stored as -1. During cleanup, signals intended for the proxy helper are then dispatched across the caller's accessible process tree. The flaw is categorized under [CWE-390: Detection of Error Condition Without Action] and requires local access, high attack complexity, low privileges, and user interaction.

Critical Impact
A local user leveraging an application that calls libssh with ProxyCommand can cause signals to be delivered to unintended processes owned by the same user, resulting in termination of those processes and local denial of service.

Affected Products

libssh library (versions prior to the fixed release referenced in Red Hat advisory RHSA-2026:42922)
Red Hat Enterprise Linux distributions shipping the affected libssh package
Downstream applications that invoke libssh with the ProxyCommand configuration option

Discovery Timeline

2026-07-21 - CVE-2026-59845 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-59845

Vulnerability Analysis

The defect resides in the ProxyCommand handling path of libssh. When the library spawns a proxy helper process, it calls fork() but does not verify the return value. On a fork() failure, the return value is -1, and libssh stores this value as the child process identifier. The cleanup routine later invokes signal-delivery functions such as kill(pid, SIGTERM) using this stored identifier.

On POSIX systems, calling kill() with a PID of -1 broadcasts the signal to every process the calling user has permission to signal. This turns a missed error check into a self-inflicted signal storm scoped to the caller's UID. The result is termination of unrelated processes owned by the same user, producing a local denial of service.

Root Cause

The root cause is a missing error-check on fork(). The library treats a failed fork as a valid child creation and preserves the sentinel value -1 for later cleanup. This maps directly to CWE-390, where an error condition is detected but no corrective action is taken before the value is reused in a security-relevant operation.

Attack Vector

Exploitation requires local access and user interaction with an application that invokes libssh with ProxyCommand enabled. An attacker must engineer a scenario in which fork() fails, typically by exhausting process table limits (RLIMIT_NPROC) or system memory. Once cleanup runs, signals fan out across the caller's process tree. The scope changes because signals reach processes outside the library's direct control, matching the CVSS scope-changed indicator.

No verified public exploit code is available. Refer to the Red Hat CVE-2026-59845 Details advisory and Red Hat Bug Report #2498178 for upstream discussion.

Detection Methods for CVE-2026-59845

Indicators of Compromise

Unexpected termination of multiple user-owned processes within a short window on hosts running libssh-linked applications.
Application logs showing ProxyCommand invocation followed by fork() failure messages such as EAGAIN or ENOMEM.
System logs recording SIGTERM or SIGKILL delivery to processes that were not direct children of the libssh caller.

Detection Strategies

Audit process termination events on Linux hosts using auditd rules watching kill syscalls with a target PID of -1.
Correlate libssh client executions using ProxyCommand with subsequent bursts of user-scope process exits.
Inventory installed libssh versions across the fleet and flag hosts running versions prior to the RHSA-2026:42922 fix level.

Monitoring Recommendations

Enable auditd monitoring of the kill and tgkill syscalls to capture broadcast-signal attempts.
Track resource-exhaustion conditions such as RLIMIT_NPROC hits, which are prerequisites to trigger the bug.
Forward host telemetry to a centralized SIEM or data lake for cross-host correlation of user-scope process kill patterns.

How to Mitigate CVE-2026-59845

Immediate Actions Required

Apply vendor updates that ship the patched libssh package, including the fix delivered in Red Hat Security Errata RHSA-2026:42922.
Inventory applications that link against libssh and use ProxyCommand, and prioritize their upgrade.
Restrict local shell access on multi-user systems where the affected library is present.

Patch Information

Red Hat has published fixed packages through Red Hat Security Errata RHSA-2026:42922. The patch adds a proper error-check on the fork() return value so that a -1 PID is never stored or reused during cleanup. Consult the Red Hat CVE-2026-59845 Details page for the complete list of affected components and errata mappings for each supported release.

Workarounds

Avoid configuring ProxyCommand in libssh-based clients until the patched library is installed.
Raise RLIMIT_NPROC and available memory for accounts that must use ProxyCommand, reducing the probability of fork() failure.
Isolate libssh client workloads under dedicated service accounts so a broadcast signal cannot reach unrelated user processes.

bash

# Example: verify installed libssh version and apply the Red Hat errata
rpm -q libssh
sudo dnf update --advisory=RHSA-2026:42922
rpm -q libssh