This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-59842 →

DEBIAN-CVE-2026-59842

A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length is copied...

Original description

The description as published by the source.

A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length is copied without proper length validation, leading to an out-of-bounds heap read. This could allow a remote unauthenticated attacker to disclose small amounts of server memory.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:14 libssh

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.1-1"}]}]

References

advisory security-tracker.debian.org