CVE-2026-15370
published 2026-07-21CVE-2026-15370: A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer…
PriorityP340high7.3CVSS 3.1
AVLACLPRLUIRSUCHIHAH
EPSS
0.17%
5.7th percentile
A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list attacker-controlled filenames, sufficiently long names can overflow that stack buffer and may lead to crashes or possible code execution on the server.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| libssh | libssh | — | — |
| libssh | libssh | — | — |
| libssh | libssh | >= 0.11.0 < 0.11.5 | 0.11.5 |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux_for_els | — | — |
| redhat | enterprise_linux_for_eus | — | — |
| redhat | enterprise_linux_for_ibm_z_systems | — | — |
| redhat | enterprise_linux_for_ibm_z_systems | — | — |
| redhat | enterprise_linux_for_ibm_z_systems_els | — | — |
| redhat | enterprise_linux_for_ibm_z_systems_eus | — | — |
| redhat | enterprise_linux_for_power_little_endian | — | — |
| redhat | enterprise_linux_for_power_little_endian | — | — |
| redhat | enterprise_linux_for_power_little_endian_els | — | — |
| redhat | enterprise_linux_for_power_little_endian_eus | — | — |
| ubuntu | libssh | — | — |
CVSS provenance
nvdv3.17.3HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
vendor_ubuntu7.3HIGH
vendor_redhat6.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Red Hat Enterprise Linux 8/9/10/Hardened Images SFTP Server longname stack-based overflow (EUVD-2026-46169)
vuldb·2026-07-21·CVSS 6.7
CVE-2026-15370 [MEDIUM] Red Hat Enterprise Linux 8/9/10/Hardened Images SFTP Server longname stack-based overflow (EUVD-2026-46169)
A vulnerability, which was classified as very critical, was found in Red Hat Enterprise Linux 8/9/10/Hardened Images. Affected is an unknown function of the component SFTP Server. Executing a manipulation of the argument longname can lead to stack-based buffer overflow.
This vulnerability is registered as CVE-2026-15370. It is possible to launch the attack remotely. No exploit is available.
GHSA
A flaw was found in libssh.
ghsa_unreviewed·2026-07-21
CVE-2026-15370 [MEDIUM] CWE-121 A flaw was found in libssh.
A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list attacker-controlled filenames, sufficiently long names can overflow that stack buffer and may lead to crashes or possible code execution on the server.
Ubuntu
libssh vulnerabilities
vendor_ubuntu·2026-08-31·CVSS 7.3
CVE-2026-59846 [HIGH] libssh vulnerabilities
Title: libssh vulnerabilities
Summary: Several security issues were fixed in libssh.
It was discovered that libssh had a stack buffer overflow in its SFTP
server when constructing directory listing entries for long filenames. An
attacker could possibly use this issue to cause libssh to crash or execute
arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-15370)
It was discovered that libssh did not correctly handle SSH channel open
messages advertising a zero maximum packet size. An authenticated remote
attacker could possibly use this issue to cause libssh to consume excessive
CPU resources, leading to a denial of service. (CVE-2026-59843)
It was discovered that libssh did not correctly limit SFTP read request
lengths in its server implementation. An authenticated remo
Red Hat
libssh: libssh: stack buffer overflow in SFTP server longname construction
vendor_redhat·2026-07-21·CVSS 6.7
CVE-2026-15370 [MEDIUM] CWE-121 libssh: libssh: stack buffer overflow in SFTP server longname construction
libssh: libssh: stack buffer overflow in SFTP server longname construction
A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list attacker-controlled filenames, sufficiently long names can overflow that stack buffer and may lead to crashes or possible code execution on the server.
Mitigation: No workaround available.
Package: libssh (Red Hat Enterprise Linux 10) - Affected
Package: libssh (Red Hat Enterprise Linux 8) - Not affected
Package: libssh (Red Hat Enterprise Linux 9) - Not affected
Package: libssh (Red Hat Hardened Images) - Affected
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-15370 libssh: libssh: stack buffer overflow in SFTP server longname construction [fedora-all]
bugzilla·2026-07-21·CVSS 6.7
CVE-2026-15370 [MEDIUM] CVE-2026-15370 libssh: libssh: stack buffer overflow in SFTP server longname construction [fedora-all]
CVE-2026-15370 libssh: libssh: stack buffer overflow in SFTP server longname construction [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in libssh server-side SFTP directory listing. In process_readdir() in src/sftpserver.c, the server allocates a fixed stack buffer as char long_name[MAX_LONG_NAME_LEN] and passes attacker-controlled directory entry names into readdir_long_name(). In the pre-patch implementation, readdir_long_name() appends metadata and the filename into z_long_name with repeated unbounded strcat() calls. Because z_long_name points at the caller-owned fixed stack buffe
Bugzilla
CVE-2026-15370 libssh: libssh: stack buffer overflow in SFTP server longname construction
bugzilla·2026-07-10·CVSS 6.7
CVE-2026-15370 [MEDIUM] CVE-2026-15370 libssh: libssh: stack buffer overflow in SFTP server longname construction
CVE-2026-15370 libssh: libssh: stack buffer overflow in SFTP server longname construction
A flaw was found in libssh server-side SFTP directory listing. In process_readdir() in src/sftpserver.c, the server allocates a fixed stack buffer as char long_name[MAX_LONG_NAME_LEN] and passes attacker-controlled directory entry names into readdir_long_name(). In the pre-patch implementation, readdir_long_name() appends metadata and the filename into z_long_name with repeated unbounded strcat() calls. Because z_long_name points at the caller-owned fixed stack buffer, sufficiently long filenames in an attacker-controlled directory can overflow that stack buffer during SSH_FXP_READDIR processing, leading to crashes and possible code execution on the server.
2026-07-21
Published