A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large length, causing a libssh SFTP… (CVE-2026-59844)
A vulnerability in libssh allows a remote authenticated client to send SSH_FXP_READ requests with an arbitrarily large length, causing the SFTP server to allocate excessive memory. This can lead to memory exhaustion through repeated requests. The issue is tracked as CVE-2026-59844 and has a moderate severity rating. Red Hat has released an update for libssh in their Hardened Images RPMs to address this flaw.
AI Analysis
Technical Summary
CVE-2026-59844 is a vulnerability in libssh where a remote authenticated client can issue SSH_FXP_READ requests specifying an arbitrarily large length. This causes the libssh SFTP server to allocate excessive memory, potentially exhausting system memory if exploited repeatedly. The vulnerability is categorized under CWE-789 (Uncontrolled Memory Allocation). Red Hat has issued a security advisory (RHSA-2026:42922) providing updated libssh packages (libssh-0.12.1-4.hum1) that fix this issue in their Hardened Images RPMs.
Potential Impact
The vulnerability allows an authenticated remote attacker to cause a denial of service by exhausting server memory through repeated large read requests. There is no impact on confidentiality or integrity reported. The primary impact is availability degradation due to resource exhaustion.
Mitigation Recommendations
Red Hat has released an official security update for libssh as part of their Hardened Images RPMs (libssh-0.12.1-4.hum1). Applying this update will remediate the vulnerability. Users of affected Red Hat Hardened Images should apply the update promptly. Patch status beyond Red Hat's advisory is not confirmed; check vendor advisories for other distributions or libssh deployments.
A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large length, causing a libssh SFTP… (CVE-2026-59844)
Description
A vulnerability in libssh allows a remote authenticated client to send SSH_FXP_READ requests with an arbitrarily large length, causing the SFTP server to allocate excessive memory. This can lead to memory exhaustion through repeated requests. The issue is tracked as CVE-2026-59844 and has a moderate severity rating. Red Hat has released an update for libssh in their Hardened Images RPMs to address this flaw.
CVSS v3.1
Score 6.5medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-59844 is a vulnerability in libssh where a remote authenticated client can issue SSH_FXP_READ requests specifying an arbitrarily large length. This causes the libssh SFTP server to allocate excessive memory, potentially exhausting system memory if exploited repeatedly. The vulnerability is categorized under CWE-789 (Uncontrolled Memory Allocation). Red Hat has issued a security advisory (RHSA-2026:42922) providing updated libssh packages (libssh-0.12.1-4.hum1) that fix this issue in their Hardened Images RPMs.
Potential Impact
The vulnerability allows an authenticated remote attacker to cause a denial of service by exhausting server memory through repeated large read requests. There is no impact on confidentiality or integrity reported. The primary impact is availability degradation due to resource exhaustion.
Mitigation Recommendations
Red Hat has released an official security update for libssh as part of their Hardened Images RPMs (libssh-0.12.1-4.hum1). Applying this update will remediate the vulnerability. Users of affected Red Hat Hardened Images should apply the update promptly. Patch status beyond Red Hat's advisory is not confirmed; check vendor advisories for other distributions or libssh deployments.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-qp28-hpg5-j7xc
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-59844"]
- Ecosystems
- []
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a6150e69c2644c7f8da1e77
Added to database: 07/22/2026, 23:23:18 UTC
Last enriched: 07/22/2026, 23:36:57 UTC
Last updated: 07/31/2026, 19:24:47 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.