Executive brief
A vulnerability in the libssh library, which provides secure communication for applications, could allow a user with valid login credentials to crash the server. By sending specially crafted file transfer requests with extremely large size values, an attacker can force the server to consume all available memory. This results in a denial of service, preventing legitimate users from accessing the system or its services.
Technical details
A memory allocation vulnerability (CWE-789) exists in the libssh SFTP server implementation, specifically within the sftp_make_client_message() function and the process_read() path in src/sftpserver.c. The server fails to enforce an upper bound on the 'len' field provided in SSH_FXP_READ requests. An authenticated remote attacker can exploit this by sending requests with an arbitrarily large length, forcing the server to allocate excessive memory. Repeated requests can lead to memory exhaustion and a denial of service (DoS) condition.
Affected products
- libssh libssh unspecified
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 10
Timeline
- 2026-07-08: other: Reported to Red Hat Bugzilla
- 2026-07-21: advisory: NVD publication date