Nixpkgs security tracker

Published

Permalink CVE-2026-59850

4.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

updated 13 hours ago by @LeSuisse Activity log

Created suggestion 15 hours ago
@LeSuisse ignored
6 packages
- libssh2
- haskellPackages.libssh
- haskellPackages.libssh2
- haskellPackages.libssh2-conduit
- python313Packages.ansible-pylibssh
- python314Packages.ansible-pylibssh
13 hours ago
@LeSuisse accepted 13 hours ago
@LeSuisse published on GitHub 13 hours ago

Libssh: libssh: use-after-free via data callbacks on closed channels

A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions.

References

https://access.redhat.com/security/cve/CVE-2026-59850 x_refsource_REDHATvdb-entry
RHBZ#2498183 issue-trackingx_refsource_REDHAT

Affected products

libssh

Matching in nixpkgs

pkgs.libssh

SSH client library

nixos-unstable 0.12.0
- nixpkgs-unstable 0.12.0
- nixos-unstable-small 0.12.0
nixos-26.05 0.12.0
- nixos-26.05-small 0.12.0
- nixpkgs-26.05-darwin 0.12.0

pkgs.libsshWithGssapi

SSH client library

nixos-unstable -
- nixos-unstable-small 0.12.0

Ignored packages (6)

pkgs.libssh2

Client-side C library implementing the SSH2 protocol

nixos-unstable 1.11.1
- nixpkgs-unstable 1.11.1
- nixos-unstable-small 1.11.1
nixos-26.05 1.11.1
- nixos-26.05-small 1.11.1
- nixpkgs-26.05-darwin 1.11.1

pkgs.haskellPackages.libssh

libssh bindings

nixos-unstable 0.1.0.0
- nixpkgs-unstable 0.1.0.0
- nixos-unstable-small 0.1.0.0
nixos-26.05 0.1.0.0
- nixos-26.05-small 0.1.0.0
- nixpkgs-26.05-darwin 0.1.0.0

pkgs.haskellPackages.libssh2

FFI bindings to libssh2 SSH2 client library (http://libssh2.org/)

nixos-unstable 0.2.0.9-unstable-2025-04-03
- nixpkgs-unstable 0.2.0.9-unstable-2025-04-03
- nixos-unstable-small 0.2.0.9-unstable-2025-04-03
nixos-26.05 0.2.0.9-unstable-2025-04-03
- nixos-26.05-small 0.2.0.9-unstable-2025-04-03
- nixpkgs-26.05-darwin 0.2.0.9-unstable-2025-04-03

pkgs.haskellPackages.libssh2-conduit

Conduit wrappers for libssh2 FFI bindings (see libssh2 package)

nixos-unstable 0.2.1
- nixpkgs-unstable 0.2.1
- nixos-unstable-small 0.2.1
nixos-26.05 0.2.1
- nixos-26.05-small 0.2.1
- nixpkgs-26.05-darwin 0.2.1

pkgs.python313Packages.ansible-pylibssh

Python bindings to client functionality of libssh specific to Ansible use case

nixos-unstable 1.4.0
- nixpkgs-unstable 1.4.0
- nixos-unstable-small 1.4.0
nixos-26.05 1.4.0
- nixos-26.05-small 1.4.0
- nixpkgs-26.05-darwin 1.4.0

pkgs.python314Packages.ansible-pylibssh