CVE-2026-59850
published 2026-07-21CVE-2026-59850: A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has…
PriorityP340high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.35%
26.4th percentile
A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| libssh | libssh | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| ubuntu | libssh | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_ubuntu7.3HIGH
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
libssh vulnerabilities
vendor_ubuntu·2026-08-31·CVSS 7.3
CVE-2026-59846 [HIGH] libssh vulnerabilities
Title: libssh vulnerabilities
Summary: Several security issues were fixed in libssh.
It was discovered that libssh had a stack buffer overflow in its SFTP
server when constructing directory listing entries for long filenames. An
attacker could possibly use this issue to cause libssh to crash or execute
arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-15370)
It was discovered that libssh did not correctly handle SSH channel open
messages advertising a zero maximum packet size. An authenticated remote
attacker could possibly use this issue to cause libssh to consume excessive
CPU resources, leading to a denial of service. (CVE-2026-59843)
It was discovered that libssh did not correctly limit SFTP read request
lengths in its server implementation. An authenticated remo
Red Hat
libssh: libssh: use-after-free via data callbacks on closed channels
vendor_redhat·2026-07-21·CVSS 4.3
CVE-2026-59850 [MEDIUM] CWE-416 libssh: libssh: use-after-free via data callbacks on closed channels
libssh: libssh: use-after-free via data callbacks on closed channels
A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions.
Mitigation: Manually verify the channel is not closed inside your channel data callbacks.
Package: libssh (Red Hat Enterprise Linux 10) - Affected
Package: libssh (Red Hat Enterprise Linux 8) - Fix deferred
Package: libssh (Red Hat Enterprise Linux 9) - Affected
Package: libssh (Red Hat Hardened Images) - Affected
GHSA
A flaw was found in libssh.
ghsa_unreviewed·2026-07-21
CVE-2026-59850 [MEDIUM] CWE-416 A flaw was found in libssh.
A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-59850 libssh: libssh: use-after-free via data callbacks on closed channels [fedora-all]
bugzilla·2026-07-21·CVSS 4.3
CVE-2026-59850 [MEDIUM] CVE-2026-59850 libssh: libssh: use-after-free via data callbacks on closed channels [fedora-all]
CVE-2026-59850 libssh: libssh: use-after-free via data callbacks on closed channels [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in libssh channel data handling. In channel_rcv_data() in src/channels.c, incoming channel DATA messages could still be processed after the channel had already been marked as remotely closed. In SFTP-backed applications and other callback-driven consumers, this creates a path where data callbacks may observe channel-associated state after it has already been torn down or freed, leading to crashes and possible use-after-free conditions.
Bugzilla
CVE-2026-59850 libssh: libssh: use-after-free via data callbacks on closed channels
bugzilla·2026-07-08·CVSS 4.3
CVE-2026-59850 [MEDIUM] CVE-2026-59850 libssh: libssh: use-after-free via data callbacks on closed channels
CVE-2026-59850 libssh: libssh: use-after-free via data callbacks on closed channels
A flaw was found in libssh channel data handling. In channel_rcv_data() in src/channels.c, incoming channel DATA messages could still be processed after the channel had already been marked as remotely closed. In SFTP-backed applications and other callback-driven consumers, this creates a path where data callbacks may observe channel-associated state after it has already been torn down or freed, leading to crashes and possible use-after-free conditions.
2026-07-21
Published