A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size… (CVE-2026-15370)
A vulnerability in libssh affects the SFTP server directory listing functionality. The longname field is constructed using unsafe concatenation into a fixed-size stack buffer, which can be overflowed by attacker-controlled filenames. This may cause server crashes or potentially allow code execution. Red Hat has issued an advisory providing updated RPM packages to address this issue.
AI Analysis
Technical Summary
CVE-2026-15370 is a stack-based buffer overflow vulnerability in libssh's SFTP server directory listing. The flaw arises because the longname field is built by concatenating attacker-controlled filenames into a fixed-size stack buffer without proper bounds checking. When a client requests a directory listing containing sufficiently long filenames, this can overflow the buffer, leading to possible denial of service or code execution on the server. Red Hat has released updated libssh RPM packages (version 0.12.2-1.hum1) as part of their Hardened Images update to remediate this issue.
Potential Impact
Exploitation of this vulnerability can lead to high confidentiality, integrity, and availability impacts, including potential remote code execution and server crashes. However, the attack vector requires local access (AV:L), low privileges (PR:L), and user interaction (UI:R), with high attack complexity (AC:H). No known exploits are reported in the wild at this time.
Mitigation Recommendations
Red Hat has released an official fix in updated libssh RPM packages (libssh-0.12.2-1.hum1 and related packages) as part of the Hardened Images update. Users of affected Red Hat Hardened Images should apply this update promptly to remediate the vulnerability. No additional mitigations are specified or required beyond applying the official update.
A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size… (CVE-2026-15370)
Description
A vulnerability in libssh affects the SFTP server directory listing functionality. The longname field is constructed using unsafe concatenation into a fixed-size stack buffer, which can be overflowed by attacker-controlled filenames. This may cause server crashes or potentially allow code execution. Red Hat has issued an advisory providing updated RPM packages to address this issue.
CVSS v3.1
Score 6.7medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-15370 is a stack-based buffer overflow vulnerability in libssh's SFTP server directory listing. The flaw arises because the longname field is built by concatenating attacker-controlled filenames into a fixed-size stack buffer without proper bounds checking. When a client requests a directory listing containing sufficiently long filenames, this can overflow the buffer, leading to possible denial of service or code execution on the server. Red Hat has released updated libssh RPM packages (version 0.12.2-1.hum1) as part of their Hardened Images update to remediate this issue.
Potential Impact
Exploitation of this vulnerability can lead to high confidentiality, integrity, and availability impacts, including potential remote code execution and server crashes. However, the attack vector requires local access (AV:L), low privileges (PR:L), and user interaction (UI:R), with high attack complexity (AC:H). No known exploits are reported in the wild at this time.
Mitigation Recommendations
Red Hat has released an official fix in updated libssh RPM packages (libssh-0.12.2-1.hum1 and related packages) as part of the Hardened Images update. Users of affected Red Hat Hardened Images should apply this update promptly to remediate the vulnerability. No additional mitigations are specified or required beyond applying the official update.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-6j7f-8jjp-mm8c
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-15370"]
- Ecosystems
- []
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a6b72bc9c2644c7f8474557
Added to database: 07/30/2026, 15:50:20 UTC
Last enriched: 07/30/2026, 19:59:30 UTC
Last updated: 07/31/2026, 19:24:51 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.