===========================================================
== Subject:     DoS by advertising max packet length zero
==
== CVE ID#:     CVE-2026-59843
==
== Versions:    libssh < 0.12.1; < 0.11.5
==
== Summary:     Advertising a maximum packet length of zero
==              in SSH_MSG_CHANNEL_OPEN causes the peer to
==              enter an infinite loop
==
===========================================================

===========
Description
===========

A remote, authenticated attacker can set the maximum packet
size to 0 in the SSH_MSG_CHANNEL_OPEN request. When the server
attempts to write to the channel in `channel_write_common()`,
it enters an infinite loop because the remaining length
of the packet to write is never decreased.

Repeating the attack over multiple connections can exhaust
the CPU capabilities of the server, causing DoS for other users.

==================
Patch Availability
==================

A patch addressing the issue has been committed to the libssh
master branch under hash 44b186fa17aff497dae420c59c003222e438103c.
Additionally, libssh 0.12.1 and 0.11.5 have been issued
as security releases to correct the defect.  SSH administrators are
advised to upgrade to these releases or apply the patch as soon
as possible.

==================
CVSSv3 calculation
==================
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (6.5)

==========
Workaround
==========

No workaround available.

=======
Credits
=======

Originally reported by Rinku Das. Independently reported
by Yi Lin and Haruto Kimura. Patch provided by Pavol Zacik
of the libssh team.

==========================================================
== The libssh team
==========================================================