CVE-2026-59849: libssh DoS Vulnerability in Authentication

CVE-2026-59849 Overview

CVE-2026-59849 is a denial-of-service vulnerability in libssh, a widely used C library implementing the SSH protocol. The flaw resides in the automatic certificate-based public key authentication logic. When configured certificates are missing or repeatedly rejected by a server, the client enters an infinite loop and consumes resources indefinitely. This vulnerability is classified under [CWE-835] (Loop with Unreachable Exit Condition). Attackers with low privileges on the network can trigger the condition by presenting servers that reject the client's certificates, causing client-side denial of service.

Critical Impact
A remote server or attacker-controlled endpoint can force libssh clients into an infinite authentication loop, exhausting client resources and preventing legitimate SSH operations.

Affected Products

libssh (versions containing the flawed automatic certificate-based public key authentication logic)
Red Hat Enterprise Linux distributions shipping affected libssh packages
Applications and tooling that link against vulnerable libssh releases

Discovery Timeline

2026-07-21 - CVE-2026-59849 published to the National Vulnerability Database
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-59849

Vulnerability Analysis

The vulnerability affects the client-side authentication state machine in libssh. During automatic certificate-based public key authentication, the library iterates over configured identities and attempts each certificate against the remote server. Logic errors in this iteration prevent the client from correctly advancing past certificates that are missing on disk or that the server rejects. Instead of exiting the authentication attempt or moving to the next available method, the client re-enters the same code path repeatedly.

The result is an infinite loop that consumes CPU cycles and blocks the calling application. Because the loop occurs during authentication, no session is established, and the calling program cannot make progress on SSH-dependent workflows. Automation systems, orchestration agents, and CI/CD pipelines that rely on libssh for outbound SSH connections are directly impacted when a server rejects the presented certificate chain.

Root Cause

The defect stems from missing termination conditions in the certificate iteration logic. When a certificate file cannot be loaded, or when the server returns repeated rejection responses, the loop counter or state transition does not advance. Reference [CWE-835] describes this class of defect as a loop with an unreachable exit condition.

Attack Vector

An attacker who controls or impersonates an SSH server can trigger the condition by consistently rejecting the client's certificate-based authentication attempts. The flaw can also be triggered accidentally by misconfigured certificate paths on the client. Successful exploitation requires that the victim client initiate an SSH connection using automatic certificate-based public key authentication. Impact is limited to availability of the client process. No confidentiality or integrity impact is present.

Refer to the Red Hat CVE-2026-59849 Details and Red Hat Bug Report #2498182 for additional technical context.

Detection Methods for CVE-2026-59849

Indicators of Compromise

Client processes linking libssh consuming sustained high CPU while attempting outbound SSH connections that never complete.
Repeated authentication attempts to the same SSH server without a successful session establishment in client or server logs.
Stalled automation jobs, cron tasks, or CI/CD steps that invoke libssh-backed clients and hang indefinitely.

Detection Strategies

Monitor process runtime and CPU utilization for tools that depend on libssh and alert on outliers that exceed expected connection timeouts.
Correlate outbound SSH connection attempts against session-established events to identify clients stuck in authentication loops.
Inspect libssh client debug logs for repeated SSH_MSG_USERAUTH_FAILURE responses tied to the same identity.

Monitoring Recommendations

Track the installed version of libssh across the fleet and flag hosts running unpatched releases.
Alert on SSH client processes exceeding a defined wall-clock threshold without producing a session key exchange completion event.
Baseline authentication attempt rates per client and investigate sustained spikes against a single destination.

How to Mitigate CVE-2026-59849

Immediate Actions Required

Apply the vendor-supplied libssh update as soon as it becomes available in your distribution channel.
Audit SSH client configurations and remove references to certificate files that do not exist on disk.
Restrict outbound SSH connections from automation hosts to known, trusted destinations to reduce exposure to hostile servers.

Patch Information

Red Hat has published fixes through Red Hat Security Advisory RHSA-2026:42922. Administrators running Red Hat Enterprise Linux or derivatives should update the libssh package using the standard package manager. Other distributions and downstream consumers of libssh should track their vendor channels for corresponding updates.

Workarounds

Disable automatic certificate-based public key authentication in client configuration until the patched libssh is deployed.
Enforce connection timeouts in wrapper scripts and orchestration frameworks so that stuck client processes are terminated automatically.
Remove missing or stale certificate entries from the SSH client identity list to prevent the loop condition from triggering.

bash

# Configuration example: update libssh on Red Hat systems
sudo dnf update libssh libssh-config

# Verify the installed version
rpm -q libssh

# Enforce a client-side timeout wrapper for automation
timeout 30 ssh -o PubkeyAuthentication=yes user@host