Threats Tagged 'cve-2026-15370'

A stack-based buffer overflow vulnerability (CVE-2026-15370) was found in libssh during SFTP server directory listing. The flaw occurs because the longname field is constructed with unsafe concatenation into a fixed-size stack buffer, allowing attacker-controlled filenames of sufficient length to overflow the buffer. This can lead to server crashes or potential code execution. Red Hat has released an update for libssh in their Hardened Images RPMs to address this issue. No workaround is available, so applying the update is necessary to mitigate the risk.

A stack-based buffer overflow vulnerability exists in libssh during SFTP server directory listing when constructing the longname field. This occurs due to unsafe concatenation into a fixed-size stack buffer, allowing an attacker to cause crashes or potentially execute code by supplying long attacker-controlled filenames. The vulnerability affects Red Hat Hardened Images RPMs including libssh packages. No workaround is available, and a fixed update has been released.

A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list attacker-controlled filenames, sufficiently long names can overflow that stack buffer and may lead to crashes or possible code execution on the server.