From a8a3fa352bb5213e08a35e4494c6e44360e2e38a Mon Sep 17 00:00:00 2001 From: Jakub Jelen Date: Wed, 1 Jul 2026 16:43:08 +0200 Subject: [PATCH] CVE-2026-59850 channels: Avoid processing DATA packets on closed channels MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Jakub Jelen Reviewed-by: Pavol Žáčik --- src/channels.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/channels.c b/src/channels.c index 00e5a8b8..e682119f 100644 --- a/src/channels.c +++ b/src/channels.c @@ -660,6 +660,13 @@ SSH_PACKET_CALLBACK(channel_rcv_data) channel->local_channel, channel->remote_channel); + if (channel->flags & SSH_CHANNEL_FLAG_CLOSED_REMOTE) { + SSH_LOG(SSH_LOG_WARNING, "Received data on (remotely) closed channel"); + ssh_set_error(session, SSH_FATAL, "Received data on (remotely) closed channel"); + SSH_STRING_FREE(str); + return SSH_PACKET_USED; + } + if (len > channel->local_window) { SSH_LOG(SSH_LOG_RARE, "Data packet too big for our window(%" PRIu32 " vs %" PRIu32 ")",