Summary
It was discovered that libssh had a stack buffer overflow in its SFTP
server when constructing directory listing entries for long filenames. An
attacker could possibly use this issue to cause libssh to crash or execute
arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-15370)
It was discovered that libssh did not correctly handle SSH channel open
messages advertising a zero maximum packet size. An authenticated remote
attacker could possibly use this issue to cause libssh to consume excessive
CPU resources, leading to a denial of service. (CVE-2026-59843)
It was discovered that libssh did not correctly limit SFTP read request
lengths in its server implementation. An authenticated remote attacker
could possibly use this issue to cause libssh to allocate excessive memory,
leading to a denial of service. This issue only affected Ubuntu 26.04 LTS.
(CVE-2026-59844)
It was discovered that libssh did not correctly handle ProxyCommand fork()
failures. A local attacker could possibly use this issue to cause a denial
of service. (CVE-2026-59845)
It was discovered that libssh did not correctly sanitize shell
metacharacters when expanding usernames in ProxyCommand strings. An
attacker could possibly use this issue to obtain sensitive information.
(CVE-2026-59846)
It was discovered that libssh had incorrect AES-GCM tag verification when
built with the OpenSSL backend. A machine-in-the-middle attacker could
possibly use this issue to modify encrypted traffic without detection.
(CVE-2026-59847)
It was discovered that libssh did not correctly handle SFTP server
responses for unknown request IDs. An attacker could possibly use this
issue to cause libssh to use excessive memory, leading to a denial of
service. (CVE-2026-59848)
It was discovered that libssh had logic errors in certificate-based
authentication that could cause clients to loop indefinitely when
certificates were rejected. An attacker could possibly use this issue to
cause a denial of service. This issue only affected Ubuntu 26.04 LTS.
(CVE-2026-59849)
It was discovered that libssh could invoke data callbacks on channels after
they had been closed. An attacker could possibly use this issue to cause
libssh to crash or execute arbitrary code. (CVE-2026-59850)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | libssh | 0.9.6-2ubuntu0.22.04.8 |
| Ubuntu · 24.04 LTS 24.04:LTS | libssh | 0.10.6-2ubuntu0.5 |
| Ubuntu · 26.04 LTS 26.04:LTS | libssh | 0.11.3-1ubuntu2.1 |
Vulnerabilities 9
-
Medium 6.7
Libssh: libssh: stack buffer overflow in sftp server longname construction
A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list attacker-controlled filenames, sufficiently long names can ov…
-
Medium 6.5
Libssh: libssh: denial of service via zero advertised channel packet size
A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later channel writes to loop indefinitely and consume CPU, leading to denial of service.
-
Medium 6.5
Libssh: libssh: denial of service via oversized sftp read length
A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests.
-
Medium 5.9
Libssh: libssh: integrity downgrade via openssl aes-gcm tag verification
A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection.
-
Medium 5.3
Libssh: libssh: denial of service via unchecked proxycommand fork() failure
A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service.
-
Medium 5.3
Libssh: libssh: denial of service via sftp responses with unknown request ids
A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service.
-
Medium 4.3
Libssh: libssh: use-after-free via data callbacks on closed channels
A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions.
-
Low 3.9
Libssh: libssh: information disclosure via proxycommand %r username expansion
A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior.
-
Low 3.1
Libssh: libssh: denial of service via automatic certificate authentication loop
A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when configured certificates are missing or repeatedly rejected by a server, leading to denial of service.
References
-
report
https://ubuntu.com/security/CVE-2026-15370
-
report
https://ubuntu.com/security/CVE-2026-59843
-
report
https://ubuntu.com/security/CVE-2026-59844
-
report
https://ubuntu.com/security/CVE-2026-59845
-
report
https://ubuntu.com/security/CVE-2026-59846
-
report
https://ubuntu.com/security/CVE-2026-59847
-
report
https://ubuntu.com/security/CVE-2026-59848
-
report
https://ubuntu.com/security/CVE-2026-59849
-
report
https://ubuntu.com/security/CVE-2026-59850