# CVE-2026-0966

## Summary

- **CVE ID:** CVE-2026-0966
- **Severity:** MEDIUM
- **CVSS Score:** 6.5 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H)
- **CWE:** CWE-124
- **Published:** Mar 26, 2026
- **Last Modified:** Sep 1, 2026

## Description

The API function `ssh_get_hexa()` is vulnerable, when 0-lenght
input is provided to this function. This function is used internally
in `ssh_get_fingerprint_hash()` and `ssh_print_hexa()` (deprecated),
which is vulnerable to the same input (length is provided by the
calling application).

The function is also used internally in the gssapi code for logging
the OIDs received by the server during GSSAPI authentication. This
could be triggered remotely, when the server allows GSSAPI authentication
and logging verbosity is set at least to SSH_LOG_PACKET (3). This
could cause self-DoS of the per-connection daemon process.

## Affected Products

- Red Hat — Red Hat Hardened Images (0.12.0-1.1.hum1)
- Red Hat — Red Hat Enterprise Linux 10 (0:0.12.0-2.el10)
- Red Hat — Red Hat Enterprise Linux 9 (0:0.10.4-18.el9)

## References

- [CNA](https://access.redhat.com/security/cve/CVE-2026-0966)
- [CNA](https://bugzilla.redhat.com/show_bug.cgi?id=2433121)
- [CNA](https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/)
- [CNA](https://access.redhat.com/errata/RHSA-2026:7067)
- [CNA](https://access.redhat.com/errata/RHSA-2026:18160)
- [CNA](https://access.redhat.com/errata/RHSA-2026:18683)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.58%
- **EPSS Percentile:** 45.9

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-11._