libssh security

Performance degradation and intermittent interruption are the key operational consequences Microsoft records for CVE-2026-0966, a libssh issue caused by a buffer underflow in ssh_get_hexa() on invalid input. The vulnerability was fixed in the libssh 0.12.0 and 0.11.4 security releases published...

Background CVE-2026-0964 is a path traversal vulnerability in libssh’s SCP client API, specifically in ssh_scp_pull_request(). In practical terms, a malicious SCP server can feed a client an unexpected path and trick the application into writing a file somewhere other than the intended working...

A successful attack against CVE-2026-0967 is not the kind of issue that can be triggered effortlessly from across the internet with a single packet and no setup. Microsoft’s own wording makes that distinction clear: the attack requires conditions beyond the attacker’s control, meaning the...

Microsoft’s listing for CVE-2026-0965 highlights a denial-of-service condition in libssh tied to improper configuration file handling, and the upstream libssh project confirms that the issue was among the security fixes shipped in its 0.12.0 and 0.11.4 releases on February 10, 2026. The...