CVE-2026-0965

low-risk
Published 2026-03-26

A flaw was found in libssh where it can attempt to open arbitrary files during configuration parsing. A local attacker can exploit this by providing a malicious configuration file or when the system is misconfigured. This vulnerability could lead to a Denial of Service (DoS) by causing the system to try and access dangerous files, such as block devices or large system files, which can disrupt normal operations.

Do I need to act?

-
0.02% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
3
CVSS 3.3/10 Low
LOCAL / LOW complexity

Affected Products (3)

Affected Vendors

Redhat Libssh

References (2)

Third Party Advisory https://access.redhat.com/security/cve/CVE-2026-0965
Third Party Advisory https://bugzilla.redhat.com/show_bug.cgi?id=2436980
22
/ 100
low-risk
Severity 13/34 · Low
Exploitability 0/34 · Minimal
Exposure 9/34 · Low