===========================================================
== Subject:     An out-of-bounds read during GSSAPI key exchange
==
== CVE ID#:     CVE-2026-59842
==
== Versions:    libssh = 0.12.0
==
== Summary:     A missing length check of peer-provided ephemeral
                Curve25519 public key causes an out-of-bounds read.
==
===========================================================

===========
Description
===========

A remote, unauthenticated attacker can trigger an out-of-bounds
read on the libssh server's heap due to a missing length check
in ssh_server_gss_kex_process_init. During GSSAPI key exchange,
an ephemeral Curve25519 public key provided by the client is
copied from an ssh_string to an ssh_crypto_struct without verifying
that the source string length matches the expected 32-byte key size.
The out-of-bounds read is therefore triggered when the client
provides a malformed public key that is shorter than 32 bytes.

By repeatedly initiating key exchanges with crafted public keys,
an attacker may attempt to leak sensitive data from the server's
heap. A successful key exchange after sending an N-byte prefix
of a public key indicates to the attacker that the remaining
32-N bytes of their key are equal to 32-N bytes of server memory
following the overrun ssh_string.

While the vulnerability theoretically allows for the recovery
of up to 32 bytes of memory, the computational complexity
scales exponentially. Specifically, recovering N bytes
would require on average 256^N key generation attempts,
making the recovery of large secrets computationally infeasible.

==================
Patch Availability
==================

A patch addressing the issue has been posted to:
https://www.libssh.org/security/
Additionally, libssh 0.12.1 has been issued
as a security release to correct the defect.
SSH administrators are advised to upgrade to this release
or apply the patch as soon as possible.

==================
CVSSv3 calculation
==================
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N (3.7)

==========
Workaround
==========
Disable GSSAPIKeyExchange or remove gss-curve25519-sha256- from
GSSAPIKexAlgorithms if appropriate.

=======
Credits
=======

Originally reported and patch provided by nevv.
Independently reported by Yi Lin and Haruki Oyama


==========================================================
== The libssh team
==========================================================