Executive brief
A vulnerability in the libssh library allows a malicious file server to crash client applications. When a user connects to a compromised or malicious SFTP server, the server can flood the client with fake data responses that the client stores indefinitely. This leads to the client application consuming all available memory, resulting in a system crash or service outage.
Technical details
A flaw was discovered in the libssh client-side SFTP message handling within the 'sftp_get_message()' function in 'src/sftp_common.c'. The library fails to validate request IDs in incoming SFTP responses, allowing responses for IDs that were never issued by the client to be accepted and queued. A malicious SFTP server can exploit this by repeatedly sending responses with unknown IDs, leading to unbounded memory consumption. This results in a client-side denial of service (DoS) via memory exhaustion. The attack requires a client to connect to a malicious or compromised server.
Affected products
- libssh libssh
- Red Hat Red Hat Enterprise Linux 8 affected
- Red Hat Red Hat Enterprise Linux 9 affected
- Red Hat Red Hat Enterprise Linux 10 affected
- Red Hat Red Hat Hardened Images affected
Timeline
- 2026-07-08: disclosed: Initial report in Red Hat Bugzilla
- 2026-07-21: advisory: CVE published and NVD record created