CVE-2026-0967 Libssh: libssh: denial of service via inefficient regular expression processing
A remote attacker can cause a denial of service in libssh clients by crafting specific hostnames that trigger inefficient regular expression backtracking.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-0967?
CVE-2026-0967 is a low-severity denial of service vulnerability in Redhat Enterprise Linux, published on 26 Mar 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A flaw was found in libssh. A remote attacker, by controlling client configuration files or known_hosts files, could craft specific hostnames that when processed by the `match_pattern()` function can lead to inefficient regular expression backtracking. This can cause timeouts and resource exhaustion, resulting in a Denial of Service (DoS) for the client.
Weakness: CWE-1333
Which versions are affected by CVE-2026-0967?
It affects 2 products.
Products include Libssh Libssh, Redhat Enterprise Linux.
How do I fix CVE-2026-0967?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-0967 being exploited?
There is no known exploitation of CVE-2026-0967 in the wild and no public exploit code.
Other vulnerabilities in Redhat Enterprise Linux
- CVE-2026-59851 Libssh: libssh: authentication bypass via missing gssapi principal check
- CVE-2025-5987 Libssh: invalid return code for chacha20 poly1305 with openssl backend
- CVE-2025-14821 Libssh: libssh: insecure default configuration leads to local man-in-the-middle attacks on windows
- CVE-2012-4560 Memory corruption in n/a
- CVE-2012-4562 Integer overflow in n/a
Sources
Also known as AZL-81092, BELL-CVE-2026-0967, DEBIAN-CVE-2026-0967, ECHO-ce8c-f3b6-b79f, GHSA-6jpg-fr24-wpvf, JLSEC-2026-782 and 2 more.