CVE-2026-0965: 
NixOS vulnerability analysis and mitigation

CVE-2026-0965 is a Denial of Service vulnerability in libssh caused by improper configuration file handling. During configuration parsing, libssh can attempt to open arbitrary files — including block devices, named pipes (FIFOs), or large system files — which can disrupt normal operations. The flaw affects libssh versions up to and including 0.11.3, as well as distributions shipping affected packages such as Red Hat Enterprise Linux 9 and 10, and Microsoft Azure Linux 3 (azl3_libssh 0.10.6-5 through 0.10.6-7). It was first reported on February 10, 2026, and has a CVSS v3.0 base score of 3.3 (Low) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-73 (External Control of File Name or Path): libssh does not restrict the types of files it will attempt to open when parsing SSH configuration files loaded from default locations or supplied via ssh_config_parse_file() and ssh_bind_config_parse_file(), including files included through glob wildcards. A local attacker with low privileges can place or reference a malicious configuration file pointing to dangerous file types (e.g., /dev/sda, a FIFO, or a very large file), causing the process to block or consume excessive resources during parsing. The fix enforces that only regular files are read and imposes a 16 MB configuration file size limit (Red Hat Bugzilla, libssh Release).

Successful exploitation results in a Denial of Service affecting the availability of any application or service that uses libssh for SSH configuration parsing. There is no confidentiality or integrity impact — the vulnerability is limited to availability (CVSS A:L). Because exploitation requires local access and low privileges, the blast radius is constrained to the affected host, with no direct path to lateral movement or data exfiltration (Red Hat CVE, Red Hat Bugzilla).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-0965. The EPSS score is approximately 0.014% (0.000140), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and low-privilege credentials, significantly limiting the attack surface (Red Hat CVE).

The libssh project released fixed versions 0.11.4 and 0.12.0 on February 10, 2026, which restrict configuration parsing to regular files only and enforce a 16 MB file size limit (libssh Release). Red Hat addressed the issue for RHEL 10 via RHSA-2026:18160 (libssh-0.12.0-2.el10) and for RHEL 9 via RHSA-2026:18683 (libssh-0.10.4-18.el9), both issued on May 19, 2026 (RHSA-2026:18160, RHSA-2026:18683). As a workaround where patching is not immediately possible, administrators should ensure that SSH configuration file paths and included glob patterns are tightly controlled and not writable by untrusted local users.

The vulnerability received routine coverage from Linux distribution security channels, including Fedora, SUSE, Ubuntu (USN-8051-1 and USN-8051-2), Slackware, and openSUSE, all issuing updated libssh packages. Splunk also published an advisory (SVD-2026-0512) referencing this CVE. No notable independent researcher commentary or significant social media discussion has been identified, consistent with the low severity rating of the vulnerability.