CVE-2026-59847

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-59847
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59847.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-59847
Downstream
AZL (1)
BELL (1)
CGA (6)
DEBIAN (1)
ECHO (1)
MGASA (1)
MINI (1)
OESA (5)
openSUSE (2)
RHSA (4)
RLSA (3)
SUSE (8)
UBUNTU (1)
Related
ALSA (3)
CGA (1)
openSUSE (2)
SUSE (8)
Published
2026-07-21T13:18:18Z
Modified
2026-09-06T03:46:21Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
Libssh: libssh: integrity downgrade via openssl aes-gcm tag verification
Details

A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection.

Database specific 
{
    "cna_assigner":  "redhat",
    "cwe_ids":  [
        "CWE-253"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59847.json"
}
References

Affected packages

Git / gitlab.com/libssh/libssh-mirror

Affected ranges

Type
GIT
Repo
https://gitlab.com/libssh/libssh-mirror
Events
Introduced
79900e5246da9a1712d8822a53aaf5fd0abc6f40
Fixed
a09fdd00416e53b6ed436df6ff14339a4f884601
Introduced
50313883f3a077458cde4ea95bf46bfeb0771b34
Last Affected
50313883f3a077458cde4ea95bf46bfeb0771b34
Database specific
Show details 
{
    "cpe":  [
        "cpe:2.3:a:libssh:libssh:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:libssh:libssh:0.12.0:*:*:*:*:*:*:*"
    ],
    "extracted_events":  [
        {
            "introduced":  "0.9.0"
        },
        {
            "fixed":  "0.11.5"
        },
        {
            "introduced":  "0.12.0"
        },
        {
            "last_affected":  "0.12.0"
        }
    ],
    "source":  [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}

Affected versions

0.*
0.12.0
libssh-0.*
libssh-0.12.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59847.json"