CVE-2026-59844: Memory Allocation with Excessive Size Value in Red Hat Red Hat Enterprise Linux 10
A vulnerability in libssh used by Red Hat Enterprise Linux 10 allows a remote authenticated client to send SSH_FXP_READ requests with an excessively large length value. This causes the SFTP server to allocate excessive memory, potentially leading to memory exhaustion through repeated requests. The issue has a CVSS score of 6.5, indicating a medium severity impact primarily affecting availability. No official patch or remediation guidance is currently confirmed from the vendor advisory.
AI Analysis
Technical Summary
CVE-2026-59844 is a vulnerability in libssh where a remote authenticated client can issue SSH_FXP_READ requests with arbitrarily large length values. This triggers excessive memory allocation by the libssh SFTP server, which can be exploited to exhaust server memory resources. The vulnerability affects Red Hat Enterprise Linux 10. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, no confidentiality or integrity impact, but high impact on availability. The vendor advisory does not currently provide patch or remediation details.
Potential Impact
The vulnerability can cause denial of service by exhausting memory on the affected system due to excessive memory allocation triggered by crafted SFTP read requests. There is no impact on confidentiality or integrity reported. Exploitation requires authentication and network access to the SFTP service.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-59844 for current remediation guidance. Until a patch is available, consider restricting access to the SFTP service to trusted users and monitoring for unusual SFTP read request sizes. No official mitigation or temporary fix is currently documented by Red Hat.
CVE-2026-59844: Memory Allocation with Excessive Size Value in Red Hat Red Hat Enterprise Linux 10
Description
A vulnerability in libssh used by Red Hat Enterprise Linux 10 allows a remote authenticated client to send SSH_FXP_READ requests with an excessively large length value. This causes the SFTP server to allocate excessive memory, potentially leading to memory exhaustion through repeated requests. The issue has a CVSS score of 6.5, indicating a medium severity impact primarily affecting availability. No official patch or remediation guidance is currently confirmed from the vendor advisory.
CVSS v3.1
Score 6.5medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-59844 is a vulnerability in libssh where a remote authenticated client can issue SSH_FXP_READ requests with arbitrarily large length values. This triggers excessive memory allocation by the libssh SFTP server, which can be exploited to exhaust server memory resources. The vulnerability affects Red Hat Enterprise Linux 10. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, no confidentiality or integrity impact, but high impact on availability. The vendor advisory does not currently provide patch or remediation details.
Potential Impact
The vulnerability can cause denial of service by exhausting memory on the affected system due to excessive memory allocation triggered by crafted SFTP read requests. There is no impact on confidentiality or integrity reported. Exploitation requires authentication and network access to the SFTP service.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-59844 for current remediation guidance. Until a patch is available, consider restricting access to the SFTP service to trusted users and monitoring for unusual SFTP read request sizes. No official mitigation or temporary fix is currently documented by Red Hat.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-07-07T15:40:24.561Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-59844","vendor":"Red Hat"}]
Threat ID: 6a5f622e2a4a8d598918bddd
Added to database: 07/21/2026, 12:12:30 UTC
Last enriched: 07/21/2026, 12:27:06 UTC
Last updated: 07/21/2026, 13:27:41 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.