Following up from the last week release, we managed to miss one of the fixes for CVE-2026-59843 so this is a fixup release including this missing commit and few more bugfixes. The version 0.11.5 already includes the fix for this CVE.
For those new to libssh, we recommend checking out our getting started tutorial. If you have any questions, feel free to join our mailing list or visit our Matrix channel.
You can download libssh-0.12.2 here.
ChangeLog for libssh 0.12.2:
Security:
- CVE-2026-59843: Denial of service via zero advertised channel packet size
Bugfixes:
- Fix fallback to default provider if FIPS provider does not have ML-KEM implementation
- Do not override explicitly set options through a configuration file to match OpenSSH behavior.
- Return SSH_KNOWN_HOSTS_UNKNOWN when GSSAPI key exchange is used without any hostkey
New API:
- API to check the GSSAPI key exchange was used for hostkey handling
- API to initiate GSSAPI keyex authentication (missing from last release)