From 5f8c72ac1d3ebf87de088e08035dafbab3fb23ee Mon Sep 17 00:00:00 2001 From: Jakub Jelen Date: Wed, 1 Jul 2026 16:43:08 +0200 Subject: [PATCH] CVE-2026-59850 channels: Avoid processing DATA packets on closed channels MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Jakub Jelen Reviewed-by: Pavol Žáčik --- src/channels.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/channels.c b/src/channels.c index 36e19598..88430791 100644 --- a/src/channels.c +++ b/src/channels.c @@ -563,6 +563,13 @@ SSH_PACKET_CALLBACK(channel_rcv_data){ channel->local_window, channel->remote_window); + if (channel->flags & SSH_CHANNEL_FLAG_CLOSED_REMOTE) { + SSH_LOG(SSH_LOG_WARNING, "Received data on (remotely) closed channel"); + ssh_set_error(session, SSH_FATAL, "Received data on (remotely) closed channel"); + SSH_STRING_FREE(str); + return SSH_PACKET_USED; + } + /* What shall we do in this case? Let's accept it anyway */ if (len > channel->local_window) { SSH_LOG(SSH_LOG_RARE,