Red Hat Security Advisory

RHSA-2026:20610

libssh security update

Released 2026-05-26 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream E4S (v.8.8) libssh-devel-0.9.6-13.el8_8.2
Red Hat Enterprise Linux AppStream TUS (v.8.8) libssh-devel-0.9.6-13.el8_8.2
Red Hat Enterprise Linux BaseOS E4S (v.8.8) libssh-0.9.6-13.el8_8.2, libssh-config-0.9.6-13.el8_8.2
Red Hat Enterprise Linux BaseOS TUS (v.8.8) libssh-0.9.6-13.el8_8.2, libssh-config-0.9.6-13.el8_8.2

Fixes 1 record

TI-2025-04824 CVE-2025-5372 · GHSA-59w5-j22f-h3rv

Libssh: incorrect return code handling in ssh_kdf() in libssh

LOW 39

A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00513 Published 2025-07-04 Partial fix · 0.11.2, 0.9.6-16.el8_10 +4 CWE-682