Vulnerability-Lookup

CVE-2026-59844 (GCVE-0-2026-59844)

Vulnerability from cvelistv5 – Published: 2026-07-21 11:32 – Updated: 2026-09-01 20:01

Title

Libssh: libssh: denial of service via oversized sftp read length

Summary

A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-21 13:11 UTC

CWE

CWE-789 - Memory Allocation with Excessive Size Value

Assigner

redhat redhat root

References

6 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:42922	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55855	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62217	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62218	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-59844	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2498177	issue-trackingx_refsource_REDHAT

Impacted products

4 products

Vendor	Product	Version
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:0.12.0-3.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:0.9.6-17.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream cpe:/o:redhat:enterprise_linux:8::baseos
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:0.10.4-19.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream cpe:/o:redhat:enterprise_linux:9::baseos
Red Hat	Red Hat Hardened Images	Unaffected: 0.12.1-4.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1

Date Public

2026-07-21 11:17

Credits

Red Hat would like to thank Chanho Kim for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59844",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-21T13:11:22.542338Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-21T14:55:29.675Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.2"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.12.0-3.el10_2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.9.6-17.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/o:redhat:enterprise_linux:8::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.9.6-17.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.10.4-19.el9_8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/o:redhat:enterprise_linux:9::baseos"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.10.4-19.el9_8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "defaultStatus": "affected",
          "packageName": "libssh-main",
          "product": "Red Hat Hardened Images",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0.12.1-4.hum1",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Chanho Kim for reporting this issue."
        }
      ],
      "datePublic": "2026-07-21T11:17:49.367Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-789",
              "description": "Memory Allocation with Excessive Size Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T20:01:43.079Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:42922",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:42922"
        },
        {
          "name": "RHSA-2026:55855",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55855"
        },
        {
          "name": "RHSA-2026:62217",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:62217"
        },
        {
          "name": "RHSA-2026:62218",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:62218"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-59844"
        },
        {
          "name": "RHBZ#2498177",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498177"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-29T10:03:47.442Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-07-21T11:17:49.367Z",
          "value": "Made public."
        }
      ],
      "title": "Libssh: libssh: denial of service via oversized sftp read length",
      "workarounds": [
        {
          "lang": "en",
          "value": "No workaround available."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-789: Memory Allocation with Excessive Size Value"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-59844",
    "datePublished": "2026-07-21T11:32:16.816Z",
    "dateReserved": "2026-07-07T15:40:24.561Z",
    "dateUpdated": "2026-09-01T20:01:43.079Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-59844",
      "date": "2026-09-03",
      "epss": "0.00567",
      "percentile": "0.4482"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-11T14:02:58.000Z",
      "cve": "CVE-2026-59844",
      "id": "msrc_CVE-2026-59844",
      "initial_release_date": "2026-07-25T01:06:12.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Libssh: libssh: denial of service via oversized sftp read length",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-59844.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-59844\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2026-07-21T12:18:57.973\",\"lastModified\":\"2026-09-01T21:18:34.473\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests.\"}],\"affected\":[{\"source\":\"secalert@redhat.com\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libssh\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10.2\"],\"versions\":[{\"version\":\"0:0.12.0-3.el10_2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libssh\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:8::appstream\",\"cpe:/o:redhat:enterprise_linux:8::baseos\"],\"versions\":[{\"version\":\"0:0.9.6-17.el8_10\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libssh\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:8::appstream\",\"cpe:/o:redhat:enterprise_linux:8::baseos\"],\"versions\":[{\"version\":\"0:0.9.6-17.el8_10\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libssh\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:9::appstream\",\"cpe:/o:redhat:enterprise_linux:9::baseos\"],\"versions\":[{\"version\":\"0:0.10.4-19.el9_8\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libssh\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:9::appstream\",\"cpe:/o:redhat:enterprise_linux:9::baseos\"],\"versions\":[{\"version\":\"0:0.10.4-19.el9_8\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"libssh-main\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"],\"versions\":[{\"version\":\"0.12.1-4.hum1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-21T13:11:22.542338Z\",\"id\":\"CVE-2026-59844\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-789\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:libssh:libssh:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9B0EB43D-D594-43B0-AB33-5E8E1A6C8BEF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:hardened_images:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"87DEB507-5B64-47D7-9A50-3B87FD1E571F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F4CFF558-3C47-480D-A2F0-BABF26042943\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F6FB57C-2BC7-487C-96DD-132683AEB35D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D65C2163-CFC2-4ABB-8F4E-CB09CEBD006C\"}]}]}],\"references\":[{\"url\":\"https://access.redhat.com/errata/RHSA-2026:42922\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:55855\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:62217\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:62218\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-59844\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2498177\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-01T20:01:38+00:00",
      "cve": "CVE-2026-59844",
      "id": "CVE-2026-59844",
      "initial_release_date": "2026-07-21T11:17:49.367000+00:00",
      "product_status:fixed": "94",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "libssh: libssh: denial of service via oversized SFTP read length",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59844.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-02T11:48:17Z",
      "cve": "CVE-2026-59844",
      "id": "CVE-2026-59844",
      "initial_release_date": "2026-07-22T16:25:05Z",
      "product_status:known_affected": "450",
      "product_status:recommended": "114",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-59844",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-59844.json",
      "version": "16"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-59844\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-21T13:11:22.542338Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-21T13:11:26.320Z\"}}], \"cna\": {\"title\": \"Libssh: libssh: denial of service via oversized sftp read length\", \"credits\": [{\"lang\": \"en\", \"value\": \"Red Hat would like to thank Chanho Kim for reporting this issue.\"}], \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Moderate\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10.2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:0.12.0-3.el10_2\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"libssh\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:8::appstream\", \"cpe:/o:redhat:enterprise_linux:8::baseos\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:0.9.6-17.el8_10\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"libssh\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:8::appstream\", \"cpe:/o:redhat:enterprise_linux:8::baseos\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:0.9.6-17.el8_10\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"libssh\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:9::appstream\", \"cpe:/o:redhat:enterprise_linux:9::baseos\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:0.10.4-19.el9_8\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"libssh\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:9::appstream\", \"cpe:/o:redhat:enterprise_linux:9::baseos\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:0.10.4-19.el9_8\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"libssh\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0.12.1-4.hum1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"libssh-main\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-04-29T10:03:47.442Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-07-21T11:17:49.367Z\", \"value\": \"Made public.\"}], \"datePublic\": \"2026-07-21T11:17:49.367Z\", \"references\": [{\"url\": \"https://access.redhat.com/errata/RHSA-2026:42922\", \"name\": \"RHSA-2026:42922\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:55855\", \"name\": \"RHSA-2026:55855\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:62217\", \"name\": \"RHSA-2026:62217\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:62218\", \"name\": \"RHSA-2026:62218\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/security/cve/CVE-2026-59844\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2498177\", \"name\": \"RHBZ#2498177\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"No workaround available.\"}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-789\", \"description\": \"Memory Allocation with Excessive Size Value\"}]}], \"providerMetadata\": {\"orgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"shortName\": \"redhat\", \"dateUpdated\": \"2026-09-01T20:01:43.079Z\"}, \"x_redhatCweChain\": \"CWE-789: Memory Allocation with Excessive Size Value\"}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-59844\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-01T20:01:43.079Z\", \"dateReserved\": \"2026-07-07T15:40:24.561Z\", \"assignerOrgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"datePublished\": \"2026-07-21T11:32:16.816Z\", \"assignerShortName\": \"redhat\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

rlsa-2026:55855

Vulnerability from osv_rocky

Published

2026-08-18 12:07

Modified

2026-09-01 12:12

Summary

Important: libssh security update

Details

libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.

Security Fix(es):

libssh: libssh: information disclosure via short GSSAPI Curve25519 public key (CVE-2026-59842)
libssh: libssh: denial of service via zero advertised channel packet size (CVE-2026-59843)
libssh: libssh: denial of service via oversized SFTP read length (CVE-2026-59844)
libssh: libssh: denial of service via unchecked ProxyCommand fork() failure (CVE-2026-59845)
libssh: libssh: information disclosure via ProxyCommand %r username expansion (CVE-2026-59846)
libssh: libssh: integrity downgrade via OpenSSL AES-GCM tag verification (CVE-2026-59847)
libssh: libssh: denial of service via SFTP responses with unknown request IDs (CVE-2026-59848)
libssh: libssh: denial of service via automatic certificate authentication loop (CVE-2026-59849)
libssh: libssh: use-after-free via data callbacks on closed channels (CVE-2026-59850)
libssh: libssh: authentication bypass via missing GSSAPI principal check (CVE-2026-59851)
libssh: libssh: stack buffer overflow in SFTP server longname construction (CVE-2026-15370)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Severity

8.8 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Credits

Rocky Enterprise Software Foundation

Red Hat

References

URL

Type

	https://errata.rockylinux.org/RLSA-2026:55855	ADVISORY
	https://bugzilla.redhat.com/show_bug.cgi?id=2498180	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2498183	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2498168	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2498184	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2498181	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2498178	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2498176	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2499049	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2498177	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2498182	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2498179	REPORT
	https://access.redhat.com/errata/RHSA-2026:55855	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Rocky Linux:10",
        "name": "libssh",
        "purl": "pkg:rpm/rocky-linux/libssh?distro=rocky-linux-10\u0026epoch=0"
      },
      "ranges": [
        {
          "database_specific": {
            "yum_repository": "BaseOS"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0:0.12.0-3.el10_2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [
    {
      "name": "Rocky Enterprise Software Foundation"
    },
    {
      "name": "Red Hat"
    }
  ],
  "database_specific": {
    "license": "CC-BY-4.0",
    "license_url": "https://creativecommons.org/licenses/by/4.0/",
    "source_advisory": "RHSA-2026:55855"
  },
  "details": "libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.\n\nSecurity Fix(es):\n\n* libssh: libssh: information disclosure via short GSSAPI Curve25519 public key (CVE-2026-59842)\n\n* libssh: libssh: denial of service via zero advertised channel packet size (CVE-2026-59843)\n\n* libssh: libssh: denial of service via oversized SFTP read length (CVE-2026-59844)\n\n* libssh: libssh: denial of service via unchecked ProxyCommand fork() failure (CVE-2026-59845)\n\n* libssh: libssh: information disclosure via ProxyCommand %r username expansion (CVE-2026-59846)\n\n* libssh: libssh: integrity downgrade via OpenSSL AES-GCM tag verification (CVE-2026-59847)\n\n* libssh: libssh: denial of service via SFTP responses with unknown request IDs (CVE-2026-59848)\n\n* libssh: libssh: denial of service via automatic certificate authentication loop (CVE-2026-59849)\n\n* libssh: libssh: use-after-free via data callbacks on closed channels (CVE-2026-59850)\n\n* libssh: libssh: authentication bypass via missing GSSAPI principal check (CVE-2026-59851)\n\n* libssh: libssh: stack buffer overflow in SFTP server longname construction (CVE-2026-15370)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
  "id": "RLSA-2026:55855",
  "modified": "2026-09-01T12:12:21.935201Z",
  "published": "2026-08-18T12:07:31.722662Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://errata.rockylinux.org/RLSA-2026:55855"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498180"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498183"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498168"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498184"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498181"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498178"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498176"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499049"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498177"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498182"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498179"
    },
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:55855"
    }
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Important: libssh security update",
  "upstream": [
    "CVE-2026-15370",
    "CVE-2026-59842",
    "CVE-2026-59843",
    "CVE-2026-59844",
    "CVE-2026-59845",
    "CVE-2026-59846",
    "CVE-2026-59847",
    "CVE-2026-59848",
    "CVE-2026-59849",
    "CVE-2026-59850",
    "CVE-2026-59851"
  ]
}

rlsa-2026:62217

Vulnerability from osv_rocky

Published

2026-09-02 06:05

Modified

2026-09-03 18:11

Summary

Moderate: libssh security update

Details

libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.

Security Fix(es):

libssh: libssh: denial of service via zero advertised channel packet size (CVE-2026-59843)
libssh: libssh: denial of service via oversized SFTP read length (CVE-2026-59844)
libssh: libssh: denial of service via unchecked ProxyCommand fork() failure (CVE-2026-59845)
libssh: libssh: information disclosure via ProxyCommand %r username expansion (CVE-2026-59846)
libssh: libssh: integrity downgrade via OpenSSL AES-GCM tag verification (CVE-2026-59847)
libssh: libssh: denial of service via SFTP responses with unknown request IDs (CVE-2026-59848)
libssh: libssh: use-after-free via data callbacks on closed channels (CVE-2026-59850)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Severity

6.5 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Credits

Rocky Enterprise Software Foundation

Red Hat

References

URL

Type

	https://errata.rockylinux.org/RLSA-2026:62217	ADVISORY
	https://bugzilla.redhat.com/show_bug.cgi?id=2498176	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2498177	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2498178	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2498179	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2498180	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2498181	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2498183	REPORT
	https://access.redhat.com/errata/RHSA-2026:62217	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Rocky Linux:9",
        "name": "libssh",
        "purl": "pkg:rpm/rocky-linux/libssh?distro=rocky-linux-9\u0026epoch=0"
      },
      "ranges": [
        {
          "database_specific": {
            "yum_repository": "BaseOS"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0:0.10.4-19.el9_8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [
    {
      "name": "Rocky Enterprise Software Foundation"
    },
    {
      "name": "Red Hat"
    }
  ],
  "database_specific": {
    "license": "CC-BY-4.0",
    "license_url": "https://creativecommons.org/licenses/by/4.0/",
    "source_advisory": "RHSA-2026:62217"
  },
  "details": "libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.\n\nSecurity Fix(es):\n\n* libssh: libssh: denial of service via zero advertised channel packet size (CVE-2026-59843)\n\n* libssh: libssh: denial of service via oversized SFTP read length (CVE-2026-59844)\n\n* libssh: libssh: denial of service via unchecked ProxyCommand fork() failure (CVE-2026-59845)\n\n* libssh: libssh: information disclosure via ProxyCommand %r username expansion (CVE-2026-59846)\n\n* libssh: libssh: integrity downgrade via OpenSSL AES-GCM tag verification (CVE-2026-59847)\n\n* libssh: libssh: denial of service via SFTP responses with unknown request IDs (CVE-2026-59848)\n\n* libssh: libssh: use-after-free via data callbacks on closed channels (CVE-2026-59850)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
  "id": "RLSA-2026:62217",
  "modified": "2026-09-03T18:11:53.790871Z",
  "published": "2026-09-02T06:05:06.352101Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://errata.rockylinux.org/RLSA-2026:62217"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498176"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498177"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498178"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498179"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498180"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498181"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498183"
    },
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:62217"
    }
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Moderate: libssh security update",
  "upstream": [
    "CVE-2026-59843",
    "CVE-2026-59844",
    "CVE-2026-59845",
    "CVE-2026-59846",
    "CVE-2026-59847",
    "CVE-2026-59848",
    "CVE-2026-59850"
  ]
}

rlsa-2026:62218

Vulnerability from osv_rocky

Published

2026-09-02 06:01

Modified

2026-09-03 18:11

Summary

Moderate: libssh security update

Details

libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.

Security Fix(es):

libssh: libssh: denial of service via zero advertised channel packet size (CVE-2026-59843)
libssh: libssh: denial of service via oversized SFTP read length (CVE-2026-59844)
libssh: libssh: denial of service via unchecked ProxyCommand fork() failure (CVE-2026-59845)
libssh: libssh: information disclosure via ProxyCommand %r username expansion (CVE-2026-59846)
libssh: libssh: integrity downgrade via OpenSSL AES-GCM tag verification (CVE-2026-59847)
libssh: libssh: denial of service via SFTP responses with unknown request IDs (CVE-2026-59848)
libssh: libssh: use-after-free via data callbacks on closed channels (CVE-2026-59850)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Severity

6.5 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Credits

Rocky Enterprise Software Foundation

Red Hat

References

URL

Type

	https://errata.rockylinux.org/RLSA-2026:62218	ADVISORY
	https://bugzilla.redhat.com/show_bug.cgi?id=2498176	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2498177	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2498178	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2498179	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2498180	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2498181	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2498183	REPORT
	https://access.redhat.com/errata/RHSA-2026:62218	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Rocky Linux:8",
        "name": "libssh",
        "purl": "pkg:rpm/rocky-linux/libssh?distro=rocky-linux-8\u0026epoch=0"
      },
      "ranges": [
        {
          "database_specific": {
            "yum_repository": "BaseOS"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0:0.9.6-17.el8_10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [
    {
      "name": "Rocky Enterprise Software Foundation"
    },
    {
      "name": "Red Hat"
    }
  ],
  "database_specific": {
    "license": "CC-BY-4.0",
    "license_url": "https://creativecommons.org/licenses/by/4.0/",
    "source_advisory": "RHSA-2026:62218"
  },
  "details": "libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.\n\nSecurity Fix(es):\n\n* libssh: libssh: denial of service via zero advertised channel packet size (CVE-2026-59843)\n\n* libssh: libssh: denial of service via oversized SFTP read length (CVE-2026-59844)\n\n* libssh: libssh: denial of service via unchecked ProxyCommand fork() failure (CVE-2026-59845)\n\n* libssh: libssh: information disclosure via ProxyCommand %r username expansion (CVE-2026-59846)\n\n* libssh: libssh: integrity downgrade via OpenSSL AES-GCM tag verification (CVE-2026-59847)\n\n* libssh: libssh: denial of service via SFTP responses with unknown request IDs (CVE-2026-59848)\n\n* libssh: libssh: use-after-free via data callbacks on closed channels (CVE-2026-59850)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
  "id": "RLSA-2026:62218",
  "modified": "2026-09-03T18:11:38.524991Z",
  "published": "2026-09-02T06:01:10.749163Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://errata.rockylinux.org/RLSA-2026:62218"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498176"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498177"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498178"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498179"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498180"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498181"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498183"
    },
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:62218"
    }
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Moderate: libssh security update",
  "upstream": [
    "CVE-2026-59843",
    "CVE-2026-59844",
    "CVE-2026-59845",
    "CVE-2026-59846",
    "CVE-2026-59847",
    "CVE-2026-59848",
    "CVE-2026-59850"
  ]
}

ubuntu-cve-2026-59844

Vulnerability from osv_ubuntu

Published

2026-07-21 12:18

Modified

2026-08-31 14:24

Summary

Details

Severity

6.5 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-59844	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-59844	REPORT
	https://www.libssh.org/2026/07/21/libssh-0-12-1-a…	REPORT
	https://www.libssh.org/security/advisories/CVE-20…	REPORT
	https://ubuntu.com/security/notices/USN-8699-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libssh-4",
            "binary_version": "0.11.3-1ubuntu2.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "libssh",
        "purl": "pkg:deb/ubuntu/libssh@0.11.3-1ubuntu2.1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.11.3-1ubuntu2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.11.2-1build1",
        "0.11.3-1",
        "0.11.3-1ubuntu1",
        "0.11.3-1ubuntu2"
      ]
    }
  ],
  "aliases": [],
  "details": "A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests.",
  "id": "UBUNTU-CVE-2026-59844",
  "modified": "2026-08-31T14:24:08Z",
  "published": "2026-07-21T12:18:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-59844"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59844"
    },
    {
      "type": "REPORT",
      "url": "https://www.libssh.org/2026/07/21/libssh-0-12-1-and-0-11-5-security-releases/"
    },
    {
      "type": "REPORT",
      "url": "https://www.libssh.org/security/advisories/CVE-2026-59844.txt"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8699-1"
    }
  ],
  "related": [
    "USN-8699-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-59844"
  ]
}

WID-SEC-W-2026-2428

Vulnerability from csaf_certbund - Published: 2026-07-20 22:00 - Updated: 2026-07-21 22:00

Summary

libssh: Mehrere Schwachstellen

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: libssh ist eine C Bibliothek für das Anbieten von SSH Diensten auf Client- und Serverseite. Sie kann genutzt werden, um aus der Ferne Programme auszuführen, Dateien zu übertragen oder als sicherer und transparenter Tunnel für entfernte Programme genutzt werden.

Angriff: Ein Angreifer kann mehrere Schwachstellen in libssh ausnutzen, um erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Angriff auszulösen und Daten zu manipulieren.

Betroffene Betriebssysteme: - Sonstiges - UNIX - Windows

CVE-2026-15370

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Open Source libssh <0.12.1 Open Source / libssh		<0.12.1

CVE-2026-59842

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Open Source libssh <0.12.1 Open Source / libssh		<0.12.1

CVE-2026-59843

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Open Source libssh <0.12.1 Open Source / libssh		<0.12.1

CVE-2026-59844

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Open Source libssh <0.12.1 Open Source / libssh		<0.12.1

CVE-2026-59845

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Open Source libssh <0.12.1 Open Source / libssh		<0.12.1

CVE-2026-59846

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Open Source libssh <0.12.1 Open Source / libssh		<0.12.1

CVE-2026-59847

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Open Source libssh <0.12.1 Open Source / libssh		<0.12.1

CVE-2026-59848

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Open Source libssh <0.12.1 Open Source / libssh		<0.12.1

CVE-2026-59849

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Open Source libssh <0.12.1 Open Source / libssh		<0.12.1

CVE-2026-59850

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Open Source libssh <0.12.1 Open Source / libssh		<0.12.1

CVE-2026-59851

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Open Source libssh <0.12.1 Open Source / libssh		<0.12.1

References

14 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://www.libssh.org/2026/07/21/libssh-0-12-1-a…	external
https://www.libssh.org/security/advisories/CVE-20…	external
https://www.libssh.org/security/advisories/CVE-20…	external
https://www.libssh.org/security/advisories/CVE-20…	external
https://www.libssh.org/security/advisories/CVE-20…	external
https://www.libssh.org/security/advisories/CVE-20…	external
https://www.libssh.org/security/advisories/CVE-20…	external
https://www.libssh.org/security/advisories/CVE-20…	external
https://www.libssh.org/security/advisories/CVE-20…	external
https://www.libssh.org/security/advisories/CVE-20…	external
https://www.libssh.org/security/advisories/CVE-20…	external
https://www.libssh.org/security/advisories/CVE-20…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "libssh ist eine C Bibliothek f\u00fcr das Anbieten von SSH Diensten auf Client- und Serverseite. Sie kann genutzt werden, um aus der Ferne Programme auszuf\u00fchren, Dateien zu \u00fcbertragen oder als sicherer und transparenter Tunnel f\u00fcr entfernte Programme genutzt werden.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in libssh ausnutzen, um erweiterte Berechtigungen zu erlangen, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Angriff auszul\u00f6sen und Daten zu manipulieren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-2428 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2428.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-2428 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2428"
      },
      {
        "category": "external",
        "summary": "libssh 0.12.1 and 0.11.5 security releases vom 2026-07-20",
        "url": "https://www.libssh.org/2026/07/21/libssh-0-12-1-and-0-11-5-security-releases/"
      },
      {
        "category": "external",
        "summary": "libssh Security Advisory vom 2026-07-20",
        "url": "https://www.libssh.org/security/advisories/CVE-2026-15370.txt"
      },
      {
        "category": "external",
        "summary": "libssh Security Advisory vom 2026-07-20",
        "url": "https://www.libssh.org/security/advisories/CVE-2026-59842.txt"
      },
      {
        "category": "external",
        "summary": "libssh Security Advisory vom 2026-07-20",
        "url": "https://www.libssh.org/security/advisories/CVE-2026-59843.txt"
      },
      {
        "category": "external",
        "summary": "libssh Security Advisory vom 2026-07-20",
        "url": "https://www.libssh.org/security/advisories/CVE-2026-59844.txt"
      },
      {
        "category": "external",
        "summary": "libssh Security Advisory vom 2026-07-20",
        "url": "https://www.libssh.org/security/advisories/CVE-2026-59845.txt"
      },
      {
        "category": "external",
        "summary": "libssh Security Advisory vom 2026-07-20",
        "url": "https://www.libssh.org/security/advisories/CVE-2026-59846.txt"
      },
      {
        "category": "external",
        "summary": "libssh Security Advisory vom 2026-07-20",
        "url": "https://www.libssh.org/security/advisories/CVE-2026-59847.txt"
      },
      {
        "category": "external",
        "summary": "libssh Security Advisory vom 2026-07-20",
        "url": "https://www.libssh.org/security/advisories/CVE-2026-59848.txt"
      },
      {
        "category": "external",
        "summary": "libssh Security Advisory vom 2026-07-20",
        "url": "https://www.libssh.org/security/advisories/CVE-2026-59849.txt"
      },
      {
        "category": "external",
        "summary": "libssh Security Advisory vom 2026-07-20",
        "url": "https://www.libssh.org/security/advisories/CVE-2026-59850.txt"
      },
      {
        "category": "external",
        "summary": "libssh Security Advisory vom 2026-07-20",
        "url": "https://www.libssh.org/security/advisories/CVE-2026-59851.txt"
      }
    ],
    "source_lang": "en-US",
    "title": "libssh: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-07-21T22:00:00.000+00:00",
      "generator": {
        "date": "2026-07-22T08:53:00.037+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-2428",
      "initial_release_date": "2026-07-20T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-07-20T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-07-21T22:00:00.000+00:00",
          "number": "2",
          "summary": "Referenz(en) aufgenommen: EUVD-2026-46169, EUVD-2026-46177, EUVD-2026-46179, EUVD-2026-46178, EUVD-2026-46176, EUVD-2026-46254, EUVD-2026-46256, EUVD-2026-46255, EUVD-2026-46263, EUVD-2026-46268, EUVD-2026-46266"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c0.12.1",
                "product": {
                  "name": "Open Source libssh \u003c0.12.1",
                  "product_id": "T056845"
                }
              },
              {
                "category": "product_version",
                "name": "0.12.1",
                "product": {
                  "name": "Open Source libssh 0.12.1",
                  "product_id": "T056845-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:libssh:libssh:0.12.1"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "libssh"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-15370",
      "product_status": {
        "known_affected": [
          "T056845"
        ]
      },
      "release_date": "2026-07-20T22:00:00.000+00:00",
      "title": "CVE-2026-15370"
    },
    {
      "cve": "CVE-2026-59842",
      "product_status": {
        "known_affected": [
          "T056845"
        ]
      },
      "release_date": "2026-07-20T22:00:00.000+00:00",
      "title": "CVE-2026-59842"
    },
    {
      "cve": "CVE-2026-59843",
      "product_status": {
        "known_affected": [
          "T056845"
        ]
      },
      "release_date": "2026-07-20T22:00:00.000+00:00",
      "title": "CVE-2026-59843"
    },
    {
      "cve": "CVE-2026-59844",
      "product_status": {
        "known_affected": [
          "T056845"
        ]
      },
      "release_date": "2026-07-20T22:00:00.000+00:00",
      "title": "CVE-2026-59844"
    },
    {
      "cve": "CVE-2026-59845",
      "product_status": {
        "known_affected": [
          "T056845"
        ]
      },
      "release_date": "2026-07-20T22:00:00.000+00:00",
      "title": "CVE-2026-59845"
    },
    {
      "cve": "CVE-2026-59846",
      "product_status": {
        "known_affected": [
          "T056845"
        ]
      },
      "release_date": "2026-07-20T22:00:00.000+00:00",
      "title": "CVE-2026-59846"
    },
    {
      "cve": "CVE-2026-59847",
      "product_status": {
        "known_affected": [
          "T056845"
        ]
      },
      "release_date": "2026-07-20T22:00:00.000+00:00",
      "title": "CVE-2026-59847"
    },
    {
      "cve": "CVE-2026-59848",
      "product_status": {
        "known_affected": [
          "T056845"
        ]
      },
      "release_date": "2026-07-20T22:00:00.000+00:00",
      "title": "CVE-2026-59848"
    },
    {
      "cve": "CVE-2026-59849",
      "product_status": {
        "known_affected": [
          "T056845"
        ]
      },
      "release_date": "2026-07-20T22:00:00.000+00:00",
      "title": "CVE-2026-59849"
    },
    {
      "cve": "CVE-2026-59850",
      "product_status": {
        "known_affected": [
          "T056845"
        ]
      },
      "release_date": "2026-07-20T22:00:00.000+00:00",
      "title": "CVE-2026-59850"
    },
    {
      "cve": "CVE-2026-59851",
      "product_status": {
        "known_affected": [
          "T056845"
        ]
      },
      "release_date": "2026-07-20T22:00:00.000+00:00",
      "title": "CVE-2026-59851"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-59844 (GCVE-0-2026-59844)

rlsa-2026:55855

Vulnerability from osv_rocky

rlsa-2026:62217

Vulnerability from osv_rocky

rlsa-2026:62218

Vulnerability from osv_rocky

ubuntu-cve-2026-59844

Vulnerability from osv_ubuntu

WID-SEC-W-2026-2428

Tags

Sightings

Nomenclature