Bug 2498178 (CVE-2026-59845)

Summary: CVE-2026-59845 libssh: libssh: denial of service via unchecked ProxyCommand fork() failure
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: kshier, rhel-process-autobot, security-response-team, stcannon, teagle, watson-tool-maintainers, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2503668    
Bug Blocks:    

Description OSIDB Bzimport 2026-07-08 18:22:43 UTC 
A flaw was found in libssh client-side ProxyCommand handling. In ssh_socket_connect_proxycommand() in src/socket.c, the return value of fork() was not checked before being stored as the proxy child PID. If fork() fails, the value -1 can be retained in state and later used during cleanup, causing signals to be sent across the caller's accessible process tree. In deployments that use ProxyCommand, this can lead to local denial of service.
Comment 4 errata-xmlrpc 2026-08-17 20:53:26 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:55855 https://access.redhat.com/errata/RHSA-2026:55855
Comment 5 errata-xmlrpc 2026-09-01 17:53:30 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:62217 https://access.redhat.com/errata/RHSA-2026:62217
Comment 6 errata-xmlrpc 2026-09-01 18:33:12 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:62218 https://access.redhat.com/errata/RHSA-2026:62218