Denial of Service Vulnerability in libssh Affects Multiple Clients
CVE-2026-59848

5.3MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Red Hat Hardened Images
Vendor
CVE Published:
21 July 2026

What is CVE-2026-59848?

A vulnerability exists in libssh, where a malicious SFTP server can exploit queued responses for unknown request IDs, leading to unbounded memory consumption. This can result in a denial of service for clients as their memory usage grows without limit, potentially causing crashes or inaccessibility. Mitigation of this issue requires users to ensure they are running an updated version of libssh.

References

https://access.redhat.com/security/cve/CVE-2026-59848
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2498181
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Aisle Research for reporting this issue.
.