ALAS2023-2026-3096

References: CVE-2026-59844  CVE-2026-59845  CVE-2026-59846  CVE-2026-59847  CVE-2026-59848  CVE-2026-59850 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests. (CVE-2026-59844)

A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service. (CVE-2026-59845)

A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior. (CVE-2026-59846)

A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection. (CVE-2026-59847)

A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service. (CVE-2026-59848)

A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions. (CVE-2026-59850)

Issue Correction:
Run dnf update libssh --releasever 2023.12.20260928 or dnf update --advisory ALAS2023-2026-3096 --releasever 2023.12.20260928 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    libssh-debugsource-0.10.6-1.amzn2023.0.9.aarch64
    libssh-debuginfo-0.10.6-1.amzn2023.0.9.aarch64
    libssh-0.10.6-1.amzn2023.0.9.aarch64
    libssh-devel-0.10.6-1.amzn2023.0.9.aarch64

noarch:
    libssh-config-0.10.6-1.amzn2023.0.9.noarch

src:
    libssh-0.10.6-1.amzn2023.0.9.src

x86_64:
    libssh-debugsource-0.10.6-1.amzn2023.0.9.x86_64
    libssh-debuginfo-0.10.6-1.amzn2023.0.9.x86_64
    libssh-0.10.6-1.amzn2023.0.9.x86_64
    libssh-devel-0.10.6-1.amzn2023.0.9.x86_64