ZeroDay Findings
Sign inSign up

Findings

CVE-2026-0967

A flaw was found in libssh.

Published Mar 26, 2026 · updated Sep 1, 2026 · libssh libssh

A flaw was found in libssh. A remote attacker, by controlling client configuration files or known_hosts files, could craft specific hostnames that when processed by the function can lead to inefficient regular expression backtracking. This can cause timeouts and resource exhaustion, resulting in a Denial of Service (DoS) for the client.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 26, 2026 · NIST NVD

    Detected

    A flaw was found in libssh. A remote attacker, by controlling client configuration files or known_hosts files, could craft specific hostnames that when processed by the function can lead to inefficient regular expression backtracking. This can cause timeouts and resource exhaustion, resulting in a Denial of Service (DoS) for the client.

  2. Sep 1, 2026 · NIST NVD

    Updated

    A flaw was found in libssh. A remote attacker, by controlling client configuration files or known_hosts files, could craft specific hostnames that when processed by the function can lead to inefficient regular expression backtracking. This can cause timeouts and resource exhaustion, resulting in a Denial of Service (DoS) for the client.

Affected

  • cpe libssh/libsshversion unspecified
  • cpe redhat/enterprise linux10.0
  • cpe redhat/enterprise linux9.0

Sources

  • CVE.orgVulnerability recordCVE-2026-0967

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-0967

    A flaw was found in libssh. A remote attacker, by controlling client configuration files or known_hosts files, could craft specific hostnames that when processed by the function can lead to inefficient regular expression backtracking. This can cause timeouts and

    nvd.nist.gov

References