Skip to content
OpenAdvisories
Medium USN-8093-2 1 CVE

libssh vulnerability

Published Aug 19, 2026 · Updated Oct 27, 2026

Ecosystem: Ubuntu

Summary

USN-8093-1 fixed a vulnerability in libssh. This update provides
the corresponsing fix for Ubuntu 26.04 LTS.

Original advisory details:

It was discovered that libssh incorrectly performed bounds checking when
processing SFTP extensions. If a client application queried extension data out
of bounds, it could cause the application to crash, resulting in a denial of
service, or exhibit unintended behavior.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 26.04 LTS 26.04:LTS libssh 0.11.3-1ubuntu2

Vulnerabilities 1

  • Medium 5.3
    CVE-2026-3731

    libssh SFTP Extension Name sftp.c sftp_extensions_get_data out-of-bounds

    A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can…

    libssh libssh libssh Debian Ubuntu Azure Linux

References

  • report
    https://ubuntu.com/security/CVE-2026-3731