Home / mailings

PDF

[USN-8051-1] libssh vulnerabilities

Posted on 18 February 2026
Ubuntu Security

==========================================================================Ubuntu Security Notice USN-8051-1
February 18, 2026

libssh vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 25.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS

Summary:

Several security issues were fixed in libssh.

Software Description:
- libssh: A tiny C SSH library

Details:

It was discovered that libssh clients incorrectly handled the key exchange
process. A remote attacker could possibly use this issue to cause libssh
clients to crash, resulting in a denial of service. (CVE-2025-8277)

It was discovered that the libssh SCP client incorrectly sanitized paths
received from servers. A remote attacker could use this issue to cause
libssh SCP clients to overwrite files outside of the working directory and
possibly execute arbitrary code. (CVE-2026-0964)

It was discovered that libssh incorrectly handled parsing configuration
files. A local attacker could possibly use this issue to cause libssh to
access non-regular files, resulting in a denial of service. (CVE-2026-0965)

It was discovered that libssh incorrectly handled the ssh_get_hexa()
function. A remote attacker could possibly use this issue to cause libssh
to crash, resulting in a denial of service. (CVE-2026-0966)

It was discovered that libssh incorrectly handled certain regular
expressions. A local attacker could possibly use this issue to cause libssh
to consume resources, resulting in a denial of service. (CVE-2026-0967)

It was discovered that the libssh SFTP client incorrectly handled certain
malformed longname fields. A remote attacker could use this issue to cause
libssh SFTP clients to crash, resulting in a denial of service, or possibly
execute arbitrary code. (CVE-2026-0968)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 25.10
libssh-4 0.11.2-1ubuntu0.2

Ubuntu 24.04 LTS
libssh-4 0.10.6-2ubuntu0.3

Ubuntu 22.04 LTS
libssh-4 0.9.6-2ubuntu0.22.04.6

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-8051-1
CVE-2025-8277, CVE-2026-0964, CVE-2026-0965, CVE-2026-0966,
CVE-2026-0967, CVE-2026-0968

Package Information:
https://launchpad.net/ubuntu/+source/libssh/0.11.2-1ubuntu0.2
https://launchpad.net/ubuntu/+source/libssh/0.10.6-2ubuntu0.3
https://launchpad.net/ubuntu/+source/libssh/0.9.6-2ubuntu0.22.04.6

--===============2220456617292466754==Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature

 

TOP