CVE-2026-59842

Name of the Vulnerable Software and Affected Versions libssh (affected versions not specified)

Description A flaw exists during server-side GSSAPI key exchange where a client-supplied Curve25519 public key shorter than the expected length is copied without proper length validation. This results in an out-of-bounds heap read, which may allow a remote unauthenticated attacker to disclose small amounts of server memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.