Medium ALAS2023-2026-1632 1 CVE

Moderate: libssh security update (Amazon Linux 2023)

Published Apr 27, 2026 · Updated Apr 30, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-0968: libssh OOB Read in sftp_parse_longname()

Fixed packages 5

Release	Package	Fixed in
Amazon Linux · 2023	libssh	0:0.10.6-1.amzn2023.0.6
Amazon Linux · 2023	libssh-config	0:0.10.6-1.amzn2023.0.6
Amazon Linux · 2023	libssh-debuginfo	0:0.10.6-1.amzn2023.0.6
Amazon Linux · 2023	libssh-debugsource	0:0.10.6-1.amzn2023.0.6
Amazon Linux · 2023	libssh-devel	0:0.10.6-1.amzn2023.0.6

Vulnerabilities 1

Low 3.1

CVE-2026-0968

Libssh: libssh: denial of service due to malformed sftp message

A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an `SSH_FXP_NAME` message during a file listing operation. This missing null check can lead to reading bey…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine

Mar 26, 2026

References

web
https://alas.aws.amazon.com/cve/html/CVE-2026-0968.html