Security readout for executives and security teams
Plain-English summary
CVE-2026-0967 can make a libssh-based client consume excessive processing time and resources when it handles a specially crafted hostname. Successful abuse can disrupt client availability, but requires influence over client configuration or known_hosts data and user interaction. The supplied assessment rates it low severity at CVSS 2.2.
Executive priority
Treat this as routine, targeted remediation rather than an emergency. Patch through normal vulnerability-management cycles, accelerating systems that ingest untrusted SSH configuration or known_hosts data. Business impact is limited to client availability in the supplied evidence, with no documented data theft, modification, or active exploitation.
Technical view
The flaw is inefficient regular-expression backtracking (CWE-1333) in libssh’s match_pattern() processing. Crafted hostnames can trigger timeouts or resource exhaustion. The supplied vector is local, high complexity, low privileges, and user interaction required, with availability impact only. Confidentiality and integrity impacts are not identified.
Likely exposure
Exposure is most likely where affected libssh packages process attacker-influenced client configuration or known_hosts entries. The bundle identifies RHEL 8, 9, and 10 packages and OpenShift 4 RHEL CoreOS components as affected. Listed RHEL 6 and 7 libssh2 packages and Red Hat Hardened Images are unaffected.
Exploitation context
The supplied sources do not establish active exploitation, and the CVE is not listed as KEV. Exploitation requires control or influence over configuration or known_hosts content containing crafted hostnames; ordinary remote network reachability alone is not described as sufficient.
Researcher notes
The source bundle identifies match_pattern() as the affected function and CWE-1333 as the weakness. Exact triggering patterns, fixed downstream package versions, and observed exploitation are not provided. RHEL 9 appears twice with identical package and CPE data, which looks duplicative rather than evidence of separate exposure.
Mitigation direction
- Review the applicable Red Hat advisories and install vendor-provided corrected packages.
- Prioritize systems processing client configuration or known_hosts data from untrusted or externally influenced sources.
- Restrict modification and distribution of SSH client configuration and known_hosts files.
- Follow upstream libssh and Red Hat guidance where an applicable fixed package is not yet identified.
Validation and detection
- Inventory libssh packages across RHEL 8, 9, 10, and OpenShift 4 environments.
- Compare installed package releases with RHSA-2026:18160 and RHSA-2026:18683 applicability and remediation details.
- Identify workflows importing or generating SSH configuration and known_hosts data from untrusted sources.
- Confirm updated systems no longer contain vendor-designated vulnerable package builds.
- Monitor affected clients for unusual timeouts or resource exhaustion during hostname pattern processing.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-1333: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupContainer behavior lookup
The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-0967 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Low
- CVSS
- 2.2 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L0.81.4redhatVulnerability scoring details
Base CVSS 3.0 score
2.2LowVector: CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Source timelineredhat
Reported to Red Hat.
- Source timelineredhat
Made public.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- RHSA-2026:18160CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:18683CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-0967CVE reference, redhat · vdb-entry, x_refsource_REDHAT
- RHBZ#2436981CVE reference, redhat · issue-tracking, x_refsource_REDHAT
- https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/CVE reference, redhat
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Inefficient Regular Expression Complexity
Inefficient Regular Expression Complexity represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.