===========================================================
== Subject:     Unhanded fork() return code during ProxyCommand execution
==
== CVE ID#:     CVE-2026-59845
==
== Versions:    libssh >= 0.9.0; < 0.12.1; < 0.11.5
==
== Summary:     Failed fork() could result in killing the whole process tree.
==
== Component:   client only
==
===========================================================

===========
Description
===========

A fork() failure during execution of a ProxyCommand (usually on low-memory
conditions) is not properly checked and leads to saving the return value (-1)
into the variable used as child PID. When the parent session is cleaned up,
the process sends the KILL signal to the process running the proxy command
(in this case -1), which results in sending this signal to the whole process
tree (the user has access to).

==================
Patch Availability
==================

Patches addressing the issues have been posted to:
https://www.libssh.org/security/
Additionally, libssh 0.12.1 and 0.11.5 have been issued
as security releases to correct the defect.  SSH administrators are
advised to upgrade to these releases or apply the patch as soon
as possible.

==================
CVSSv3 calculation
==================
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H (6.5)

==========
Workaround
==========
Do not use ad-hoc ProxyCommands. Use the libssh ProxyJump implementation.

=======
Credits
=======

Originally reported by Halil Oktay (oblivionsage).
Patches provided by Jakub Jelen of the libssh team.

==========================================================
== The libssh team
==========================================================