CVE-2026-59848
published 2026-07-21CVE-2026-59848: A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded…
PriorityP428medium5.3CVSS 3.1
AVNACLPRNUINSUCNINAL
EPSS
0.34%
26.0th percentile
A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| libssh | libssh | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| ubuntu | libssh | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
vendor_ubuntu7.3HIGH
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
libssh vulnerabilities
vendor_ubuntu·2026-08-31·CVSS 7.3
CVE-2026-59846 [HIGH] libssh vulnerabilities
Title: libssh vulnerabilities
Summary: Several security issues were fixed in libssh.
It was discovered that libssh had a stack buffer overflow in its SFTP
server when constructing directory listing entries for long filenames. An
attacker could possibly use this issue to cause libssh to crash or execute
arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-15370)
It was discovered that libssh did not correctly handle SSH channel open
messages advertising a zero maximum packet size. An authenticated remote
attacker could possibly use this issue to cause libssh to consume excessive
CPU resources, leading to a denial of service. (CVE-2026-59843)
It was discovered that libssh did not correctly limit SFTP read request
lengths in its server implementation. An authenticated remo
Red Hat
libssh: libssh: denial of service via SFTP responses with unknown request IDs
vendor_redhat·2026-07-21·CVSS 5.3
CVE-2026-59848 [MEDIUM] libssh: libssh: denial of service via SFTP responses with unknown request IDs
libssh: libssh: denial of service via SFTP responses with unknown request IDs
A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service.
Mitigation: Do not connect to untrusted SFTP servers.
Package: libssh (Red Hat Enterprise Linux 10) - Fix deferred
Package: libssh (Red Hat Enterprise Linux 8) - Fix deferred
Package: libssh (Red Hat Enterprise Linux 9) - Affected
Package: libssh (Red Hat Hardened Images) - Affected
GHSA
A flaw was found in libssh.
ghsa_unreviewed·2026-07-21
CVE-2026-59848 [MEDIUM] A flaw was found in libssh.
A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-59848 libssh: libssh: denial of service via SFTP responses with unknown request IDs [fedora-all]
bugzilla·2026-07-21·CVSS 5.3
CVE-2026-59848 [MEDIUM] CVE-2026-59848 libssh: libssh: denial of service via SFTP responses with unknown request IDs [fedora-all]
CVE-2026-59848 libssh: libssh: denial of service via SFTP responses with unknown request IDs [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in libssh client-side SFTP message handling. In sftp_get_message() in src/sftp_common.c, SFTP responses carrying unknown request IDs were accepted and kept queued instead of being rejected. A malicious SFTP server can repeatedly send responses for request IDs that were never issued by the client, causing unbounded growth of queued messages and leading to client-side memory exhaustion and denial of service.
Bugzilla
CVE-2026-59848 libssh: libssh: denial of service via SFTP responses with unknown request IDs
bugzilla·2026-07-08·CVSS 5.3
CVE-2026-59848 [MEDIUM] CVE-2026-59848 libssh: libssh: denial of service via SFTP responses with unknown request IDs
CVE-2026-59848 libssh: libssh: denial of service via SFTP responses with unknown request IDs
A flaw was found in libssh client-side SFTP message handling. In sftp_get_message() in src/sftp_common.c, SFTP responses carrying unknown request IDs were accepted and kept queued instead of being rejected. A malicious SFTP server can repeatedly send responses for request IDs that were never issued by the client, causing unbounded growth of queued messages and leading to client-side memory exhaustion and denial of service.
2026-07-21
Published