Memory Abuse Vulnerability in libssh SFTP Server
CVE-2026-59844

6.5MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Vendor
CVE Published:
21 July 2026

What is CVE-2026-59844?

A vulnerability exists in the libssh SFTP server whereby a remote authenticated client can issue SSH_FXP_READ requests with excessively large lengths. This behavior leads to significant memory allocation demands, presenting the risk of depleting server resources through repeated requests. It is crucial for administrators to monitor their servers and implement safeguards to mitigate the potential impact of this flaw.

References

https://access.redhat.com/security/cve/CVE-2026-59844
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2498177
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Chanho Kim for reporting this issue.
.