CVE-2026-0967: 
NixOS vulnerability analysis and mitigation

CVE-2026-0967 is a Denial of Service vulnerability in libssh caused by inefficient regular expression processing in the match_pattern() function. A remote attacker who can control client SSH configuration files or known_hosts files can craft specific hostnames that trigger catastrophic backtracking in the regex engine, leading to timeouts and resource exhaustion on the client. The flaw affects libssh versions up to and including 0.11.3, as well as Red Hat Enterprise Linux 9 and 10 distributions shipping affected libssh packages. It was first reported on February 10, 2026, and has a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-1333 (Inefficient Regular Expression Complexity), also mapped to CAPEC-492 (Regular Expression Exponential Blowup). The match_pattern() function in libssh is used to evaluate conditionals in SSH client configuration files and known_hosts entries against the hostname being connected to. When an attacker controls the content of these files — for example, by placing a malicious known_hosts file in a user-writable location or via a compromised configuration source — they can supply specially crafted hostname patterns that cause the regex engine to perform exponential backtracking, consuming excessive CPU and time. Exploitation requires local access to influence configuration files and user interaction (the victim must initiate an SSH connection), making the attack vector local with user interaction required (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation results in a Denial of Service affecting only the libssh client process — there is no confidentiality or integrity impact. The client application using libssh will experience severe performance degradation or hang indefinitely while processing the malicious hostname pattern, effectively preventing SSH connectivity. The impact is limited in scope to the affected client and does not enable lateral movement, code execution, or data exfiltration (Red Hat CVE, Red Hat Bugzilla).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-0967. The EPSS score is approximately 0.066%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack requires an attacker to control SSH client configuration or known_hosts files, which significantly limits the practical attack surface (Red Hat CVE).

1. Precondition — Control configuration files: The attacker must be able to write to or influence the victim's SSH client configuration file (e.g., ~/.ssh/config) or known_hosts file (e.g., ~/.ssh/known_hosts). This could occur via a shared filesystem, a compromised configuration management system, or social engineering.
2. Craft malicious hostname pattern: Insert a specially crafted hostname pattern into the controlled file that, when evaluated by match_pattern(), triggers exponential regex backtracking. The pattern exploits ambiguity in the regex engine (e.g., nested quantifiers or overlapping character classes).
3. Trigger victim SSH connection: Wait for or induce the victim user to initiate an SSH connection using the libssh-based client. The client will load the malicious configuration or known_hosts file during connection setup.
4. Achieve DoS: The match_pattern() function processes the crafted hostname against the malicious pattern, causing the regex engine to backtrack exponentially. The client process hangs or times out, resulting in a Denial of Service (Red Hat Bugzilla).

• File System: Unexpected or recently modified ~/.ssh/known_hosts or ~/.ssh/config files containing unusual hostname patterns with complex wildcard or regex-like constructs; files owned or modified by unexpected users.
• Process: SSH client processes (or applications embedding libssh) consuming abnormally high CPU for extended periods during connection attempts; processes in uninterruptible sleep or hanging without completing connections.
• Logs: Application or system logs showing repeated SSH connection timeouts or failures; audit logs indicating unexpected writes to SSH configuration directories by non-owner users.

The libssh project released fixed versions 0.11.4 and 0.12.0 on February 10, 2026, which modify the pattern matching logic to avoid needless backtracking (libssh Security Release). Red Hat addressed the issue for RHEL 10 via RHSA-2026:18160 (libssh-0.12.0-2.el10) and for RHEL 9 via RHSA-2026:18683 (libssh-0.10.4-18.el9), both issued on May 19, 2026 (RHSA-2026:18160, RHSA-2026:18683). As a workaround, administrators should ensure that SSH client configuration files and known_hosts files are writable only by the owning user, and audit these files for unexpected or complex hostname patterns. Upgrading to a patched libssh version is the recommended remediation.

The vulnerability received routine coverage from Linux distribution security channels, including Fedora, SUSE, Ubuntu (USN-8051-1 and USN-8051-2), Slackware, and openSUSE, all issuing updated libssh packages. Meinberg Global also published a security advisory (MBGSA-2026-03) for their LANTIME firmware incorporating the fix. Splunk issued advisory SVD-2026-0512 referencing this CVE. Community reaction has been low-key, consistent with the moderate severity and limited exploitability of the issue, with no notable researcher commentary or significant media coverage beyond standard Linux security update channels.