fix(cve): CVE-2026-59843 - CVE-2026-59843 channels: Fail when receiving max packet size 0

debian/changelog

@@ -1,3 +1,9 @@
+libssh (0.11.3-1deepin14) unstable; urgency=medium
+
+  * fix(cve): CVE-2026-59843
+
+ -- deepin-ci-robot <packages@deepin.org>  Mon, 27 Jul 2026 21:05:22 +0800
+
 libssh (0.11.3-1deepin13) unstable; urgency=medium
 
   * fix(cve): CVE-2026-59846

debian/patches/CVE-2026-59843.patch

@@ -0,0 +1,54 @@
+Description: CVE-2026-59843 - 安全修复
+Author: Pavol Žáčik <pzacik@redhat.com>
+Origin: https://gitlab.com/libssh/libssh-mirror/commit/687ef1c44b646b9db0b1c6e8f987edb7c9e4d919
+Bug: https://nvd.nist.gov/vuln/detail/CVE-2026-59843
+Last-Update: 2026-03-06 13:58:30 +0100
+---
+diff --git a/src/channels.c b/src/channels.c
+index 60eb27c..914251c 100644
+--- a/src/channels.c
++++ b/src/channels.c
+@@ -195,6 +195,13 @@ SSH_PACKET_CALLBACK(ssh_packet_channel_open_conf){
+   if (rc != SSH_OK)
+       goto error;
+
++  if (channel->remote_maxpacket == 0) {
++      SSH_LOG(SSH_LOG_RARE,
++              "Invalid maximum packet size 0 in "
++              "SSH2_MSG_CHANNEL_OPEN_CONFIRMATION");
++      goto error;
++  }
++
+   SSH_LOG(SSH_LOG_DEBUG,
+       "Received a CHANNEL_OPEN_CONFIRMATION for channel %" PRIu32 ":%" PRIu32,
+       channel->local_channel,
+diff --git a/src/messages.c b/src/messages.c
+index a9f5279..658458b 100644
+--- a/src/messages.c
++++ b/src/messages.c
+@@ -1203,10 +1203,21 @@ SSH_PACKET_CALLBACK(ssh_packet_channel_open){
+   SSH_LOG(SSH_LOG_PACKET,
+       "Clients wants to open a %s channel", type_c);
+
+-  ssh_buffer_unpack(packet,"ddd",
+-          &msg->channel_request_open.sender,
+-          &msg->channel_request_open.window,
+-          &msg->channel_request_open.packet_size);
++  rc = ssh_buffer_unpack(packet,
++                         "ddd",
++                         &msg->channel_request_open.sender,
++                         &msg->channel_request_open.window,
++                         &msg->channel_request_open.packet_size);
++  if (rc != SSH_OK){
++      goto error;
++  }
++
++  if (msg->channel_request_open.packet_size == 0) {
++      ssh_set_error(session,
++                    SSH_FATAL,
++                    "Invalid maximum packet size 0 in SSH2_MSG_CHANNEL_OPEN");
++      goto error;
++  }
+
+   if (session->session_state != SSH_SESSION_STATE_AUTHENTICATED){
+     ssh_set_error(session,SSH_FATAL, "Invalid state when receiving channel open request (must be authenticated)");

debian/patches/series

@@ -14,3 +14,4 @@ CVE-2026-59845.patch
 CVE-2026-59850.patch
 CVE-2026-59849.patch
 CVE-2026-59846.patch
+CVE-2026-59843.patch