Input Validation Flaw in SSH API Function Affecting Red Hat Software
CVE-2026-0966

6.5MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Vendor
CVE Published:
26 March 2026

What is CVE-2026-0966?

The SSH API function ssh_get_hexa() has a vulnerability when it processes zero-length input. This function is critical for internal operations such as generating fingerprints and logging OIDs during GSSAPI authentication. When GSSAPI authentication is enabled on the server and logging verbosity is set to a minimum level, this issue can be exploited to trigger a self-denial-of-service condition in the daemon process associated with the SSH connection.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://access.redhat.com/security/cve/CVE-2026-0966
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2433121
issue-trackingx_refsource_REDHAT
https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-...

CVSS V3.0

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Jakub Jelen (libssh), Jun Xu, Kang Yang, and Yunhang Zhang for reporting this issue.
JSON
.