A vulnerability in libssh allows a malicious SFTP server to send responses with unknown request IDs that libssh clients queue indefinitely, leading to unbounded memory growth and client-side denial of service. This flaw is identified as CVE-2026-59848 and has a CVSS v3.1 base score of 5.3 (medium severity). The issue affects libssh clients that interact with untrusted SFTP servers. Red Hat has released an update for libssh in their Hardened Images RPMs to address this vulnerability.