Bug 2436980 (CVE-2026-0965)

Summary: CVE-2026-0965 libssh: libssh: Denial of Service via improper configuration file handling
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: adudiak, kshier, security-response-team, stcannon, teagle, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in libssh where it can attempt to open arbitrary files during configuration parsing. A local attacker can exploit this by providing a malicious configuration file or when the system is misconfigured. This vulnerability could lead to a Denial of Service (DoS) by causing the system to try and access dangerous files, such as block devices or large system files, which can disrupt normal operations.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2442910, 2442911    
Bug Blocks:    

Description OSIDB Bzimport 2026-02-04 23:43:12 UTC 
libssh can try to open any file during configuration parsing, when
misconfigured or when local attacker can provide malicious configuration.
This applies for all configuration loaded from default location,
configuration provided through the `ssh_config_parse_file()` and
`ssh_bind_config_parse_file()` functions as well as configuration files
included from them directly or through glob wildcards.

The possibly dangerous files involve block devices, fifo, named pipe or
huge system files that could cause Denial of Service.

The solution here is allowing to read only regular files and enforcing
configuration file size limit of 16MB. Currently, maximum line length
of a configuration file is 1K so this will effectively mean configuration
files of 16K lines should still keep working.