Threats Tagged 'cve-2026-59848'

This Red Hat security advisory addresses multiple vulnerabilities in libssh, including a stack buffer overflow in the SFTP server longname construction (CVE-2026-15370) and several denial of service issues, information disclosure, integrity downgrade, and use-after-free vulnerabilities. The update to libssh version 0.12.2-1.hum1 fixes these issues and includes various bug fixes and enhancements. The advisory applies to Red Hat Hardened Images RPMs and related packages. No known exploits in the wild have been reported.

Multiple security vulnerabilities were found and fixed in libssh, including a critical stack buffer overflow in the SFTP server's longname construction. This flaw allows attackers to cause buffer overflows by listing attacker-controlled filenames, potentially leading to crashes or code execution. Other issues include denial of service, information disclosure, integrity downgrade, and use-after-free vulnerabilities. Red Hat released updated packages (libssh-0.12.2-1.hum1) that address these issues. No workaround exists for the critical buffer overflow, so applying the update is necessary.

This update includes the following RPMs: libssh: * libssh-0.12.1-4.hum1 (aarch64, x86_64) * libssh-config-0.12.1-4.hum1 (noarch) * libssh-devel-0.12.1-4.hum1 (aarch64, x86_64) * libssh-0.12.1-4.hum1.src (src)

A vulnerability in libssh allows a malicious SFTP server to send responses with unknown request IDs that libssh clients queue indefinitely, leading to unbounded memory growth and client-side denial of service. This flaw is identified as CVE-2026-59848 and has a CVSS v3.1 base score of 5.3 (medium severity). The issue affects libssh clients that interact with untrusted SFTP servers. Red Hat has released an update for libssh in their Hardened Images RPMs to address this vulnerability.

A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service.