CVE-2026-0966
Gravedad CVSS v3.1:
MEDIA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
26/03/2026
Última modificación:
26/03/2026
Descripción
*** Pendiente de traducción *** The API function `ssh_get_hexa()` is vulnerable, when 0-lenght<br />
input is provided to this function. This function is used internally<br />
in `ssh_get_fingerprint_hash()` and `ssh_print_hexa()` (deprecated),<br />
which is vulnerable to the same input (length is provided by the<br />
calling application).<br />
<br />
The function is also used internally in the gssapi code for logging<br />
the OIDs received by the server during GSSAPI authentication. This<br />
could be triggered remotely, when the server allows GSSAPI authentication<br />
and logging verbosity is set at least to SSH_LOG_PACKET (3). This<br />
could cause self-DoS of the per-connection daemon process.
Impacto
Puntuación base 3.x
6.50
Gravedad 3.x
MEDIA