A vulnerability in libssh allows a remote authenticated client to send SSH_FXP_READ requests with an arbitrarily large length, causing the SFTP server to allocate excessive memory. This can lead to memory exhaustion and denial of service through repeated requests. The issue is tracked as CVE-2026-59844 with a CVSS score of 6.5 (medium severity). Red Hat has released an update for libssh to address this flaw. No workaround is available, so applying the vendor's update is the recommended mitigation.