CVE-2026-59847: Libssh

High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days.

A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection.

Affected products

• Libssh Libssh: from 0.9.0, before 0.11.5 (fixed in 0.11.5); version 0.12.0 only
• Red Hat Enterprise Linux: version 8.0 only; version 9.0 only; version 10.0 only
• Red Hat Hardened Images: affected versions not specified

Published 2026-07-21. Last modified 2026-09-04.