CVE-2026-59844
published 2026-07-21CVE-2026-59844: A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large length, causing a libssh SFTP server to…
PriorityP339medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.57%
45.7th percentile
A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| libssh | libssh | — | — |
| libssh2 | libssh2 | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| ubuntu | libssh | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_ubuntu7.3HIGH
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A flaw was found in libssh.
ghsa_unreviewed·2026-07-21
CVE-2026-59844 [MEDIUM] CWE-789 A flaw was found in libssh.
A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests.
Ubuntu
libssh vulnerabilities
vendor_ubuntu·2026-08-31·CVSS 7.3
CVE-2026-59846 [HIGH] libssh vulnerabilities
Title: libssh vulnerabilities
Summary: Several security issues were fixed in libssh.
It was discovered that libssh had a stack buffer overflow in its SFTP
server when constructing directory listing entries for long filenames. An
attacker could possibly use this issue to cause libssh to crash or execute
arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-15370)
It was discovered that libssh did not correctly handle SSH channel open
messages advertising a zero maximum packet size. An authenticated remote
attacker could possibly use this issue to cause libssh to consume excessive
CPU resources, leading to a denial of service. (CVE-2026-59843)
It was discovered that libssh did not correctly limit SFTP read request
lengths in its server implementation. An authenticated remo
Red Hat
libssh: libssh: denial of service via oversized SFTP read length
vendor_redhat·2026-07-21·CVSS 6.5
CVE-2026-59844 [MEDIUM] CWE-789 libssh: libssh: denial of service via oversized SFTP read length
libssh: libssh: denial of service via oversized SFTP read length
A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests.
Mitigation: No workaround available.
Package: libssh (Red Hat Enterprise Linux 10) - Fix deferred
Package: libssh2 (Red Hat Enterprise Linux 7) - Under investigation
Package: libssh (Red Hat Enterprise Linux 8) - Fix deferred
Package: libssh (Red Hat Enterprise Linux 9) - Fix deferred
Package: libssh (Red Hat Hardened Images) - Affected
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-59844 libssh: libssh: denial of service via oversized SFTP read length [fedora-all]
bugzilla·2026-07-21·CVSS 6.5
CVE-2026-59844 [MEDIUM] CVE-2026-59844 libssh: libssh: denial of service via oversized SFTP read length [fedora-all]
CVE-2026-59844 libssh: libssh: denial of service via oversized SFTP read length [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in libssh server-side SFTP request handling. In sftp_make_client_message() and the downstream process_read() path in src/sftpserver.c, the implementation accepts a client-controlled SSH_FXP_READ length without enforcing a reasonable upper bound. The parsed len field later drives memory allocation in the SFTP server read path, so a remote authenticated client can request an excessively large read length and force the server to allocate excessive memory. Repeate
Bugzilla
CVE-2026-59844 libssh: libssh: denial of service via oversized SFTP read length
bugzilla·2026-07-08·CVSS 6.5
CVE-2026-59844 [MEDIUM] CVE-2026-59844 libssh: libssh: denial of service via oversized SFTP read length
CVE-2026-59844 libssh: libssh: denial of service via oversized SFTP read length
A flaw was found in libssh server-side SFTP request handling. In sftp_make_client_message() and the downstream process_read() path in src/sftpserver.c, the implementation accepts a client-controlled SSH_FXP_READ length without enforcing a reasonable upper bound. The parsed len field later drives memory allocation in the SFTP server read path, so a remote authenticated client can request an excessively large read length and force the server to allocate excessive memory. Repeated requests can exhaust available memory and lead to denial of service.
2026-07-21
Published