Description
A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | libssh | 0.11.0, 0.11.1, 0.11.2, 0.11.3 | 0.11.4 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libssh | 0.12.0-1 | — |
| Debian 13 | libssh | 0.11.5-0+deb13u1 | — |
| Debian 12 | libssh | 0.10.6-0+deb12u3 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | libssh | 0.11.3-1ubuntu2 | USN-8093-2 |
| Ubuntu 25.10 | libssh | 0.11.2-1ubuntu0.3 | USN-8093-1 |
| Ubuntu 24.04 LTS | libssh | 0.10.6-2ubuntu0.4 | USN-8093-1 |
| Ubuntu 22.04 LTS | libssh | 0.9.6-2ubuntu0.22.04.7 | USN-8093-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | libssh | 0.9.3-2ubuntu2.5+esm4 | USN-8093-1 |
| Ubuntu Pro 18.04 LTS | libssh | 0.8.0~20170825.94fa1e38-1ubuntu0.7+esm7 | USN-8093-1 |
| Ubuntu Pro 16.04 LTS | libssh | 0.6.3-4.3ubuntu0.6+esm5 | USN-8093-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | libssh +2 | 0.12.0-1.1.hum1 | RHSA-2026:7067 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | libssh | 0.9.8-150600.11.12.1 | SUSE-SU-2026:1310-1 |
| SLES 12 SP5 | libssh | 0.6.3-12.28.1 | SUSE-SU-2026:3302-1, SUSE-SU-2026:1344-1 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 6.1 | libssh | 0.10.6-slfo.1.1_5.1 | SUSE-SU-2026:20767-1 |
| SLE Micro 6.0 | libssh | 0.10.6-5.1 | SUSE-SU-2026:23056-1 |
| SLE Micro 5.5 | libssh | 0.9.8-150400.3.17.1 | SUSE-SU-2026:1565-1 |
| SLE Micro 5.4 | libssh | 0.9.8-150400.3.17.1 | SUSE-SU-2026:1565-1 |
| SLE Micro 5.3 | libssh | 0.9.8-150400.3.17.1 | SUSE-SU-2026:1565-1 |
| SLE Micro 5.2 | libssh | 0.9.8-150200.13.18.1 | SUSE-SU-2026:0936-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.6 | libssh | 0.9.8-150600.11.12.1 | SUSE-SU-2026:1310-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | libssh +2 | 0.10.6-1.amzn2023.0.7 | ALAS2023-2026-1759 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | libssh | 0.10.6-6 | — |
| Azure Linux 2 (CBL-Mariner) | libssh | No fix yet | — |
Advisories 13
- USN-8093-2 libssh vulnerability Ubuntu Security Notices (USN) · Oct 27, 2026
- USN-8093-1 libssh vulnerability Ubuntu Security Notices (USN) · Oct 27, 2026
- WID-SEC-2026-1007 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 25, 2026
- WID-SEC-2026-0634 libssh: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Oct 20, 2026
- RHSA-2026:7067 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- SUSE-SU-2026:23056-1 Security update for libssh SUSE / openSUSE Security Updates · Aug 12, 2026
- SUSE-SU-2026:3302-1 Security update for libssh SUSE / openSUSE Security Updates · Jul 28, 2026
- ALAS2023-2026-1759 Moderate: libssh security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 25, 2026
- SUSE-SU-2026:1565-1 Security update for libssh SUSE / openSUSE Security Updates · Apr 24, 2026
- SUSE-SU-2026:1344-1 Security update for libssh SUSE / openSUSE Security Updates · Apr 16, 2026
- SUSE-SU-2026:1310-1 Security update for libssh SUSE / openSUSE Security Updates · Apr 15, 2026
- SUSE-SU-2026:20767-1 Security update for libssh SUSE / openSUSE Security Updates · Mar 25, 2026
- SUSE-SU-2026:0936-1 Security update for libssh SUSE / openSUSE Security Updates · Mar 21, 2026
References
- VDB-349709 | libssh SFTP Extension Name sftp.c sftp_extensions_get_data out-of-bounds vdb-entry technical-description
- VDB-349709 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #767120 | libssh.org libssh libssh < 0.11.4; < 0.12.0 Out-of-Bounds Read third-party-advisory
- https://www.libssh.org/security/advisories/libssh-2026-sftp-extensions.txt related
- https://gitlab.com/libssh/libssh-mirror/-/commit/855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60 patch
- https://www.libssh.org/files/0.12/libssh-0.12.0.tar.xz patch