CVE-2026-59845: Libssh: libssh: denial of service via unchecked proxycommand fork() failure
Published Jul 8, 2026
·Updated
A flaw was found in libssh client-side ProxyCommand handling. In sshsocketconnectproxycommand() in src/socket.c, the return value of fork() was not checked before being stored as the proxy child PID. If fork() fails, the value -1 can be retained in state and later used during cleanup, causing signals to be sent across the caller's accessible process tree. In deployments that use ProxyCommand, this can lead to local denial of service.
Other sources
A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service.
— MITRE
Affected Software
1 affected component
libssh libssh
Event History
Jul 8, 2026
Data Sourced
via Red Hat·06:22 PM
DescriptionSeverityAffected Software
Jul 21, 2026
CVE Published
via MITRE·11:26 AM
Data Sourced
via MITRE·11:26 AM
DescriptionSeverity
Data Sourced
via NVD·12:18 PM
DescriptionSeverityWeakness