CVE-2026-59849

HighCVSS 7.5/10Last modified Nov 6, 2026

Description

A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when configured certificates are missing or repeatedly rejected by a server, leading to denial of service.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-835

Affected software

VendorProductVersions
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Hardened Images—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 9—

References

Timeline

Published
Jul 21, 2026
Last modified
Nov 6, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-59857.3A security flaw has been discovered in code-projects Simple IT Discussion Forum 1.0. The affected element is an unknown function of the fileCVE-2026-598507.5A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associaCVE-2026-598518.8A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated KerbeCVE-2026-598536.5SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /api/storage/getCriteria endpoint returns saved search crCVE-2026-598544.9SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, POST /api/file/globalCopyFiles accepts attacker-supplied absoCVE-2026-598558.6SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, Asset.render in app/src/asset/index.ts interpolates the unsanCVE-2026-598567.8Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interCVE-2026-598575.5Vim is an open source, command line text editor. Prior to 9.2.0725, the single-byte branch of spell_soundfold_sal() in src/spell.c translateCVE-2026-598587.8Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolaCVE-2026-598598.7Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.4, Kiota's PHP generator embedded OpenAPI description, defaulCVE-2026-59865.3A weakness has been identified in Zod jsVideoUrlParser up to 0.5.1. The impacted element is the function getTime in the library lib/util.js.CVE-2026-598608.7Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.3, Kiota is affected by a code-generation injection vulnerabi