CVE-2026-59842 — Libssh: libssh: information disclosure via short gssapi curve25519 public key
A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length is copied without proper length vali…
Published: 2026-07-21 · CVSS: 3.7 · CVSS 3.1
A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length is copied without proper length validation, leading to an out-of-bounds heap read. This could allow a remote unauthenticated attacker to disclose small amounts of server memory.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7