{"action":"Upgrade libssh to 0.7.6-r0 or later.","affected":[{"fixed":"0.7.6-r0","introduced":"0.6.0"}],"component":"libssh","cve_ids":[],"ecosystem":"Alpine","ecosystem_qualifier":"Alpine:v3.9","exploited":false,"fixed_versions":["0.7.6-r0"],"id":"tcs_01M5NA3B47VV12JXV1G2ABAA7T","modified_at":"2026-10-23T17:17:55.202160047Z","published_at":"2018-10-17T12:29:00.650Z","references":["https://osv.dev/vulnerability/ALPINE-CVE-2018-10933","https://security.alpinelinux.org/vuln/CVE-2018-10933"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"ALPINE-CVE-2018-10933#Alpine:v3.9/libssh","url":"https://osv.dev/vulnerability/ALPINE-CVE-2018-10933"}],"summary":"A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthor"}