===========================================================
== Subject:     Automatic authentication using certificates
==              could result in infinite loop
==
== CVE ID#:     CVE-2026-59849
==
== Versions:    libssh >= 0.11.0;  < 0.12.1;  < 0.11.5
==
== Summary:     Malicious server could cause infinite loop
==              in specific configurations
==
== Component:   client only
==
===========================================================

===========
Description
===========

The logic errors in the automatic public key authentication
`ssh_userauth_publickey_auto()` can cause the client enter
infinite loop when the certificate file configured through
options does not exist or the server rejects it (and does
not implement any authentication limit, which is uncommon).

The issue is caused by not moving the certificate iterator
to the next item on these errors and by restarting the iterator
after we reach the end of the list.

==================
Patch Availability
==================

Patches addressing the issues have been posted to:
https://www.libssh.org/security/
Additionally, libssh 0.12.1 and 0.11.5 have been issued
as security releases to correct the defect.  SSH administrators are
advised to upgrade to these releases or apply the patch as soon
as possible.

==================
CVSSv3 calculation
==================
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L (3.1)

==========
Workaround
==========

Do not connect to untrusted SSH servers and do not use
certificates until patched.

=======
Credits
=======

Originally reported by AISLE in partnership with Red Hat.
Patches provided by Jakub Jelen of the libssh team.

==========================================================
== The libssh team
==========================================================