Technology · Libssh
Libssh vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 26 vulnerabilities in Libssh: 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-59851, was published on 21 July 2026.
- Last 7 days
- 0
- Last 90 days
- 0
- Critical, all time
- 0
- Exploited in the wild
- 0
About Libssh
C library implementing the SSH protocol for secure remote communication and file transfer.
Latest Libssh vulnerabilities
- CVE-2026-59851: libssh authentication bypass in GSSAPIKeyExchangehighCVSS 8.8
- CVE-2026-59850: libssh use-after-free in channel data callbacksmediumCVSS 4.3
- CVE-2026-59849: libssh infinite loop in certificate-based authenticationlowCVSS 3.1
- CVE-2026-59848: libssh denial of service via memory exhaustion in SFTP clientmediumCVSS 5.3
- CVE-2026-59847: libssh integrity protection bypass in OpenSSL AES-GCM backendmediumCVSS 5.9
- CVE-2026-59846: libssh shell metacharacter injection in ProxyCommand username expansionlowCVSS 3.9
- CVE-2026-59845: libssh denial of service via unchecked fork failure in ProxyCommandmediumCVSS 5.3
- CVE-2026-59844: libssh denial of service via oversized SFTP read lengthmediumCVSS 6.5
- CVE-2026-59843: libssh denial of service via zero maximum packet sizemediumCVSS 6.5
- CVE-2026-59842: libssh out-of-bounds read in GSSAPI Curve25519 key exchangelowCVSS 3.7
- CVE-2026-15370: libssh stack buffer overflow in SFTP server directory listingmediumCVSS 6.7
- CVE-2025-14821: libssh insecure default configuration on WindowshighCVSS 7.8EPSS 0.1%
- CVE-2026-0968: libssh heap out-of-bounds read in sftp_parse_longnamelowCVSS 3.1EPSS 0.0%
- CVE-2026-0967: libssh ReDoS in match_pattern functionmediumCVSS 5.5EPSS 0.0%
- CVE-2026-0966: libssh denial of service in ssh_get_hexa functionhighCVSS 8.2EPSS 0.1%
- CVE-2026-0965: libssh Denial of Service via arbitrary file access in configuration parsinglowCVSS 3.3EPSS 0.0%
- CVE-2026-0964: libssh SCP path traversal in ssh_scp_pull_requestmediumCVSS 6.3EPSS 0.0%
- CVE-2025-8277: libssh memory exhaustion via repeated key exchange guesseslowCVSS 3.1EPSS 0.1%
- CVE-2025-4877: libssh heap overflow in binary to base64 conversionmediumCVSS 4.5EPSS 0.0%
- CVE-2025-5449: libssh integer overflow in SFTP server message decodingmediumCVSS 6.5EPSS 0.7%
- CVE-2025-8114: libssh NULL pointer dereference in KEX session ID calculationmediumCVSS 4.7EPSS 0.0%
- CVE-2025-4878: libssh uninitialized variable in privatekey_from_filelowCVSS 3.6EPSS 0.1%
- CVE-2025-5987: libssh improper error handling in ChaCha20 cipher initializationhighCVSS 8.1EPSS 1.4%
- CVE-2025-5351: libssh double free in key export functionalitymediumCVSS 6.5EPSS 0.4%
- CVE-2025-5372: libssh incorrect return code handling in ssh_kdfmediumCVSS 5EPSS 0.3%
Most severe Libssh vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-59851: libssh authentication bypass in GSSAPIKeyExchangehighCVSS 8.8
- CVE-2026-0966: libssh denial of service in ssh_get_hexa functionhighCVSS 8.2EPSS 0.1%
- CVE-2025-5987: libssh improper error handling in ChaCha20 cipher initializationhighCVSS 8.1EPSS 1.4%
- CVE-2025-14821: libssh insecure default configuration on WindowshighCVSS 7.8EPSS 0.1%
- CVE-2026-15370: libssh stack buffer overflow in SFTP server directory listingmediumCVSS 6.7
- CVE-2025-5449: libssh integer overflow in SFTP server message decodingmediumCVSS 6.5EPSS 0.7%
- CVE-2025-5351: libssh double free in key export functionalitymediumCVSS 6.5EPSS 0.4%
- CVE-2026-59844: libssh denial of service via oversized SFTP read lengthmediumCVSS 6.5
- CVE-2026-59843: libssh denial of service via zero maximum packet sizemediumCVSS 6.5
- CVE-2026-0964: libssh SCP path traversal in ssh_scp_pull_requestmediumCVSS 6.3EPSS 0.0%
Vulnerabilities per week
Nothing was published in the last eight weeks. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Libssh vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/libssh)<a href="https://junglewise.ai/threats/technologies/libssh"><img src="https://junglewise.ai/threats/technologies/libssh/badge.svg" alt="Libssh vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/libssh.json, and this page as text at https://junglewise.ai/threats/technologies/libssh.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Libssh vulnerabilities", https://junglewise.ai/threats/technologies/libssh, 9 November 2026.