CVE-2026-0967
Description
A flaw was found in libssh. A remote attacker, by controlling client configuration files or known_hosts files, could craft specific hostnames that when processed by the match_pattern() function can lead to inefficient regular expression backtracking. This can cause timeouts and resource exhaustion, resulting in a Denial of Service (DoS) for the client.
Statement
The vulnerability in libssh has been rated as Low by Red Hat Product Security.
This issue arises from inefficient pattern matching logic that may lead to excessive processing time when handling specially crafted patterns. However, these patterns originate from configuration data, meaning an attacker would need the ability to modify or influence configuration files to exploit the issue.
As a result, exploitation requires local access or equivalent local privileges, and cannot be performed remotely without prior compromise. Additionally, triggering the issue depends on specific conditions during pattern evaluation, increasing the attack complexity.
The impact of this flaw is limited to potential performance degradation or temporary delays due to increased CPU usage. It does not allow unauthorized access to data, modification of system state, or execution of arbitrary code.
Mitigation
Avoid using complex patterns in configuration files and known_hosts.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 2.2 | 5.5 | 2.2 |
| Attack Vector | Local | Local | Local |
| Attack Complexity | High | Low | High |
| Privileges Required | Low | None | Low |
| User Interaction | Required | Required | Required |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | None | None | None |
| Integrity Impact | None | None | None |
| Availability Impact | Low | High | Low |
Vector
Red Hat: CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L
NVD: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
cve.org: CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU)
Attackers can create crafted inputs that intentionally cause the regular expression to use excessive backtracking in a way that causes the CPU consumption to spike.
Acknowledgements
Red Hat would like to thank Jakub Jelen (libssh) and Kang Yang for reporting this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
