CVE-2026-59847— Libssh: libssh: integrity downgrade via openssl aes-gcm tag verification
Possible ATT&CK Techniques 1AI
T1557 · Adversary-in-the-MiddleAffected Version Matrix 4
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | any | affected |
| Red Hat | Red Hat Enterprise Linux 8 | any | affected |
| Red Hat | Red Hat Enterprise Linux 9 | any | affected |
| Red Hat | Red Hat Hardened Images | 0.12.1-4.hum1< * | unaffected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-59847
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Libssh: libssh: integrity downgrade via openssl aes-gcm tag verification
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
libssh 硬件供应链问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
libssh是libssh组织开源的一个用于访问SSH服务的C语言开发包,它能够执行远程命令、文件传输,同时为远程的程序提供安全的传输通道。 libssh存在硬件供应链问题漏洞，该漏洞源于libssh中基于OpenSSL后端的构建AES-GCM检查不当，可能导致路径内攻击者修改明文而不被发现。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Hardened Images | 0.12.1-4.hum1 ~ * | cpe:/a:redhat:hummingbird:1 | |
| Red Hat | Red Hat Enterprise Linux 10 | - | cpe:/o:redhat:enterprise_linux:10 | |
| Red Hat | Red Hat Enterprise Linux 8 | - | cpe:/o:redhat:enterprise_linux:8 | |
| Red Hat | Red Hat Enterprise Linux 9 | - | cpe:/o:redhat:enterprise_linux:9 |
II. Public POCs for CVE-2026-59847
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-59847
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-59847 (3)
- 🔗 2498180 – (CVE-2026-59847) CVE-2026-59847 libssh: libssh: integrity downgrade via OpenSSL AES-GCM tag verification Read full article issue-trackingx_refsource_REDHAT
Same Patch Batch · Red Hat · 2026-07-21 · 20 CVEs total
| CVE-2026-59851 | 8.8 HIGH | Libssh: libssh: authentication bypass via missing gssapi principal check |
| CVE-2026-16493 | 7.8 HIGH | Ansible-core: argument injection in ansible-galaxy collection install via git clone (incom |
| CVE-2026-16445 | 7.5 HIGH | Dracut: dracut: root code execution via dhcp options command injection in networkmanager i |
| CVE-2026-15927 | 6.8 MEDIUM | Quay: mirror-registry: ssrf: repo-level mirror accepts external_reference without url vali |
| CVE-2026-15370 | 6.7 MEDIUM | Libssh: libssh: stack buffer overflow in sftp server longname construction |
| CVE-2026-59843 | 6.5 MEDIUM | Libssh: libssh: denial of service via zero advertised channel packet size |
| CVE-2026-16461 | 6.5 MEDIUM | Rpcbind: rpcbind: stack buffer overflow in rpcinfo rpcbdump() short-mode version-list form |
| CVE-2026-59844 | 6.5 MEDIUM | Libssh: libssh: denial of service via oversized sftp read length |
| CVE-2026-15811 | 5.8 MEDIUM | Kronosnet: kronosnet: encryption key exposure in memory after cryptographic configuration |
| CVE-2026-59845 | 5.3 MEDIUM | Libssh: libssh: denial of service via unchecked proxycommand fork() failure |
| CVE-2026-59848 | 5.3 MEDIUM | Libssh: libssh: denial of service via sftp responses with unknown request ids |
| CVE-2026-15812 | 4.8 MEDIUM | Kronosnet: kronosnet: access control list bypass via link id spoofing on unencrypted dynam |
| CVE-2026-59850 | 4.3 MEDIUM | Libssh: libssh: use-after-free via data callbacks on closed channels |
| CVE-2026-12548 | 4.2 MEDIUM | Libsoup: heap out-of-bounds read in libsoup due to integer truncation |
| CVE-2026-59846 | 3.9 LOW | Libssh: libssh: information disclosure via proxycommand %r username expansion |
| CVE-2026-59842 | 3.7 LOW | Libssh: libssh: information disclosure via short gssapi curve25519 public key |
| CVE-2026-12547 | 3.4 LOW | Libsoup: information disclosure in libsoup via soupauthmanager proxy credential leak on pr |
| CVE-2026-59849 | 3.1 LOW | Libssh: libssh: denial of service via automatic certificate authentication loop |
| CVE-2026-16517 | 2.9 LOW | Libarchive: libarchive: signed integer overflow in archive_write_zip_header |
IV. Related Vulnerabilities
Same product: Red Hat Hardened Images
- CVE-2026-16517
Libarchive: libarchive: signed integer overflow in archive_w - CVE-2026-59851
Libssh: libssh: authentication bypass via missing gssapi pri - CVE-2026-59850
Libssh: libssh: use-after-free via data callbacks on closed - CVE-2026-59849
Libssh: libssh: denial of service via automatic certificate - CVE-2026-59848
Libssh: libssh: denial of service via sftp responses with un
Same vendor: Red Hat
- CVE-2026-12383
Eda-server: externaleventstreamviewset trusts subject header - CVE-2026-66759
Gimp: out-of-bounds read in file-icns plugin causes informat - CVE-2026-66757
Gimp: signed integer overflow in file-sgi (sgi-lib) causes t - CVE-2026-66758
Gimp: integer overflow in file-fits plugin causes a heap-bas - CVE-2026-15003
Binutils: gnu binutils: heap-buffer-overflow in linker leads
V. Comments for CVE-2026-59847
No comments yet