CVE-2026-59850 PUBLISHED

Libssh: libssh: use-after-free via data callbacks on closed channels

Assigner: redhat
Reserved: 07.07.2026 Published: 21.07.2026 Updated: 21.07.2026

A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS Score: 4.3

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	Low	Integrity Impact	None
User Interaction	None	Availability Impact	Low

CVSS 3.1

Product Status

Vendor	Red Hat
Product	Red Hat Enterprise Linux 10
Versions	Default: affected

Vendor	Red Hat
Product	Red Hat Enterprise Linux 8
Versions	Default: affected

Vendor	Red Hat
Product	Red Hat Enterprise Linux 9
Versions	Default: affected

Vendor	Red Hat
Product	Red Hat Hardened Images
Versions	Default: affected

Workarounds

Manually verify the channel is not closed inside your channel data callbacks.

Credits

Red Hat would like to thank Zhou Qingyang for reporting this issue.

References

Problem Types

Use After Free CWE