CVE-2026-0966
The API function `ssh_get_hexa()` is vulnerable, when 0-lenght input is provided to this function. This function is used internally in `ssh_get_fingerprint_hash()` and `ssh_print_hexa()` (deprecated), which is vulnerable to the same input (length is provided by the calling application). The function is also used internally in the gssapi code for logging the OIDs received by the server during GSSAPI authentication. This could be triggered remotely, when the server allows GSSAPI authentication and logging verbosity is set at least to SSH_LOG_PACKET (3). This could cause self-DoS of the per-connection daemon process.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.5
- CVSS vector
- CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
- EPSS probability
- 0.58%
- CWE
- CWE-124
- Published
- 2026-03-26
- Last modified
- 2026-09-01
Affected products
- Red Hat Red Hat Hardened Images
- Red Hat Red Hat Enterprise Linux 10
- Red Hat Red Hat Enterprise Linux 9
Weakness type
Related vulnerabilities
- CVE-2026-40013 — An attacker that has valid credentials can submit a Sieve script containing an extreme numeric...
- CVE-2026-73075 — Vim: Out-of-bounds Access in Popup Opacity Handling
- CVE-2026-71969 — OP-TEE OS 4.10.0 Buffer Underwrite via RSA NOPAD Encrypt/Decrypt Operations
- CVE-2026-16439 — Eclipse OpenJ9 : Using -Xtrace to trace method arguments can lead to buffer underflow
- CVE-2026-26199 — Buffer underflow in `H5Iget_name `/`H5G_get_name` if size is zero
- CVE-2026-44631 — Apache HTTP Server: Heap Underflow in `ap_regname` via Signed Char Overflow
- CVE-2024-36343 — Improper input validation in the System Management Mode (SMM) communications buffer could allow a...
- CVE-2026-5089 — YAML::Syck versions before 1.38 for Perl has an out-of-bounds read