CVE-2026-59848

MEDIUM5.3Denial of service

Description

A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service.

CVSS breakdown

CVSS 3.1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Affected products

libssh / libssh
RedHat / enterprise_linux8.0 – 8.0
RedHat / enterprise_linux9.0 – 9.0
RedHat / enterprise_linux10.0 – 10.0
RedHat / hardened_images

References

VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:42922
VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:55855
VENDOR_ADVISORYhttps://access.redhat.com/security/cve/CVE-2026-59848
MISChttps://bugzilla.redhat.com/show_bug.cgi?id=2498181

Updated 17m ago · 8 sources