The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4844 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4844-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Simon Quigley     October 20, 2026                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : libssh     Version        : 0.10.6-0+deb12u3     CVE ID         : CVE-2026-0964 CVE-2026-0965 CVE-2026-0966 CVE-2026-0967                      CVE-2026-0968 CVE-2026-3731 CVE-2026-59843 CVE-2026-59844                      CVE-2026-59845 CVE-2026-59846 CVE-2026-59847 CVE-2026-59848                      CVE-2026-59850

    Several vulnerabilities were discovered in libssh, a tiny C SSH library.

    CVE-2026-0964

        A malicious SCP server can send a path that escapes the working         directory. This is the same issue as OpenSSH CVE-2019-6111.

    CVE-2026-0965

        Parsing a configuration file that is not a regular file, or that is         too large, could be used for a denial of service.

    CVE-2026-0966

        ssh_get_hexa() could underflow a heap buffer on invalid input.

    CVE-2026-0967

        A crafted pattern in a configuration or known_hosts file could make         match_pattern() backtrack until it times out.

    CVE-2026-0968

        A malicious SFTP server can send a longname that         sftp_parse_longname() reads past.

    CVE-2026-3731

        sftp_extensions_get_name() and sftp_extensions_get_data() did not         reject an index past the end of the extension list.

    CVE-2026-59843

        A peer that advertises a maximum channel packet size of 0 can cause         a denial of service.

    CVE-2026-59844

        An oversized length in an SSH_FXP_READ request can cause a denial of         service.

    CVE-2026-59845

        ProxyCommand did not check the return value of fork(), which can         cause a denial of service.

    CVE-2026-59846

        A username containing shell metacharacters could be expanded into         ProxyCommand via %r.

    CVE-2026-59847

        With the OpenSSL backend, a failed AES-GCM tag check could be         treated as success. The gcrypt backend was already correct.

    CVE-2026-59848

        An SFTP response with a request id the client did not send could         cause a denial of service.

    CVE-2026-59850

        A DATA packet on a remotely closed channel could be delivered to a         callback after the channel was freed.

    For Debian 12 bookworm, these problems have been fixed in version     0.10.6-0+deb12u3.

    We recommend that you upgrade your libssh packages.

    For the detailed security status of libssh please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libssh

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:18160 advisory.

    * libssh: Buffer underflow in ssh_get_hexa() on invalid input (CVE-2026-0966)

    * libssh: Improper sanitation of paths received from SCP servers (CVE-2026-0964)

    * libssh: libssh: Denial of Service via improper configuration file handling (CVE-2026-0965)

    * libssh: libssh: Denial of Service via inefficient regular expression processing (CVE-2026-0967)

    * libssh: libssh: Denial of Service due to malformed SFTP message (CVE-2026-0968)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libssh package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    A path traversal vulnerability exists in libssh when processing paths received from SCP servers. Attackers     can bypass security restrictions by crafting malicious path parameters to access or manipulate file system     paths beyond the intended scope. This vulnerability stems from insufficient validation and sanitization of     filename paths returned by SCP servers.(CVE-2026-0964)

    No description is available for this CVE.(CVE-2026-0968)

    A vulnerability was found in libssh (unknown version). It has been declared as problematic.The CWE     definition for the vulnerability is CWE-120. The product copies an input buffer to an output buffer     without verifying that the size of the input buffer is less than the size of the output buffer, leading to     a buffer overflow.As an impact it is known to affect availability.There is no information about possible     countermeasures known. It may be suggested to replace the affected object with an alternative     product.(CVE-2026-0966)

    libssh can try to open any file during configuration parsing, when misconfigured or when local attacker     can provide malicious configuration. This applies for all configuration loaded from default location,     configuration provided through the `ssh_config_parse_file()` and `ssh_bind_config_parse_file()` functions     as well as configuration files included from them directly or through glob wildcards.  The possibly     dangerous files involve block devices, fifo, named pipe or huge system files that could cause Denial of     Service.  The solution here is allowing to read only regular files and enforcing configuration file size     limit of 16MB. Currently, maximum line length of a configuration file is 1K so this will effectively mean     configuration files of 16K lines should still keep working.(CVE-2026-0965)

    The function `match_pattern()` is used to match conditionals in client configuration files or known hosts     against the hostname the client is connecting to.  When the configuration file or known_hosts file is     controlled by the attacker, connecting to specific hostnames could cause timeouts and resource exhaustion     due to the ineffective backtracking of complex regular expressions.  The pattern matching was modified to     avoid the needless backtracing.(CVE-2026-0967)

    A weakness has been identified in libssh up to 0.11.3. The impacted element is the function     sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension     Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may     be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This     patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected     component.(CVE-2026-3731)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization libssh security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_18683 advisory.

    * libssh: Double Free Vulnerability in libssh Key Export Functions (CVE-2025-5351)

    * libssh: Use of uninitialized variable in privatekey_from_file() (CVE-2025-4878)

    * libssh: Write beyond bounds in binary to base64 conversion functions (CVE-2025-4877)

    * libssh: NULL Pointer Dereference in libssh KEX Session ID Calculation (CVE-2025-8114)

    * libssh: Memory Exhaustion via Repeated Key Exchange in libssh (CVE-2025-8277)

    * libssh: Buffer underflow in ssh_get_hexa() on invalid input (CVE-2026-0966)

    * libssh: Improper sanitation of paths received from SCP servers (CVE-2026-0964)

    * libssh: libssh: Denial of Service via improper configuration file handling (CVE-2026-0965)

    * libssh: libssh: Denial of Service via inefficient regular expression processing (CVE-2026-0967)

    * libssh: libssh: Denial of Service due to malformed SFTP message (CVE-2026-0968)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
372635	Debian dla-4844 : libssh-4 - security update	Nessus	Debian Local Security Checks	2026/10/27	2026/10/28	medium
318292	RockyLinux 10 : libssh (RLSA-2026:18160)	Nessus	Rocky Linux Local Security Checks	2026/6/3	2026/6/3	high
377453	EulerOS Virtualization 2.15.0 : libssh (EulerOS-SA-2026-4604)	Nessus	Huawei Local Security Checks	2026/11/7	2026/11/7	medium
355927	Rocky Linux 9 [CIQ] Security Update: libssh / libssh-config / libssh-debuginfo / libssh-debugsource / etc Multiple Vulnerabilities (crlsa-2026_18683)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high

検出

プラグインの検索

medium

high

medium

high