Skip to main content

libssh CVE-2026-15370

| EUVDEUVD-2026-46169 HIGH
Stack-based Buffer Overflow (CWE-121)
2026-07-21 secalert@redhat.com GHSA-6j7f-8jjp-mm8c
RCE Buffer Overflow Stack Overflow Libssh Hardened Images Enterprise Linux
7.3
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.3 HIGH
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
vuln.today AI
8.8 HIGH

SFTP is network-reachable (AV:N) and needs an authenticated session able to create/list files (PR:L); the attacker drives the listing themselves so UI:N, with memory corruption yielding full C/I/A.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.7 MEDIUM
AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Red Hat
6.7 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Updated
Jul 30, 2026 - 13:31 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 30, 2026 - 13:22 vuln.today
cvss_changed
Severity Changed
Jul 30, 2026 - 13:22 NVD
MEDIUM HIGH
CVSS changed
Jul 30, 2026 - 13:22 NVD
6.7 (MEDIUM) 7.3 (HIGH)
Analysis Generated
Jul 21, 2026 - 09:31 vuln.today

DescriptionNVD

A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list attacker-controlled filenames, sufficiently long names can overflow that stack buffer and may lead to crashes or possible code execution on the server.

AnalysisAI

Stack-based buffer overflow in libssh's SFTP server allows a connected client to crash the server or potentially execute code by placing files with overlong names into a directory the server subsequently lists. The flaw lives in how libssh builds the SFTP 'longname' field, concatenating attacker-influenced filenames into a fixed-size stack buffer without adequate bounds checking. There is no public exploit identified at time of analysis and EPSS is very low (0.10%), but the memory-corruption nature (CWE-121) and libssh's broad deployment make it worth prioritized patching.

Technical ContextAI

libssh is a widely used C implementation of the SSH2 protocol providing both client and server (including SFTP subsystem) functionality, embedded in many applications and Linux distributions. The vulnerability is a CWE-121 stack-based buffer overflow triggered in the SFTP server's directory-listing path: SFTP responses include a human-readable 'longname' string (an ls -l style line combining permissions, owner, size and the filename). libssh constructs this line via unsafe concatenation into a fixed-size stack buffer, so a filename long enough to exceed the buffer overwrites adjacent stack memory. CPE data confirms the affected component is libssh itself (cpe:2.3:a:libssh:libssh) as shipped in Red Hat Enterprise Linux 10.0 (cpe:2.3:o:redhat:enterprise_linux:10.0) and Red Hat hardened images.

RemediationAI

Patch available per Red Hat advisory RHSA-2026:47768 (https://access.redhat.com/errata/RHSA-2026:47768); on RHEL 10 and Red Hat hardened images, update the libssh packages to the fixed build and restart or redeploy services that link the library, then confirm no statically linked copies remain unpatched. An exact upstream libssh release version is not provided in the source data and should be confirmed against the libssh project release notes before pinning. Where immediate patching is not possible, compensating controls include restricting SFTP write access so untrusted users cannot create arbitrary filenames (this blocks the injection vector but breaks legitimate uploads), enforcing filename-length limits at the application or chroot layer, and limiting network exposure of the SFTP service to trusted networks/VPN (reduces reachable attack surface at the cost of remote-access convenience). Ensure stack protections (canaries, FORTIFY_SOURCE) are enabled to reduce crashes to non-exploitable failures rather than code execution.

More in Libssh

View all
CVE-2023-48795 MEDIUM POC
5.9 Dec 18

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
CVE-2018-10933 CRITICAL POC
9.1 Oct 17

A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. Rated critical severity
CVE-2020-16135 MEDIUM POC
5.9 Jul 29

libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL. Rated medium severity (CVSS

CVE-2012-4562 HIGH
7.5 Nov 30

Multiple integer overflows in libssh before 0.5.3 allow remote attackers to cause a denial of service (infinite loop or

CVE-2012-4560 HIGH
7.5 Nov 30

Multiple buffer overflows in libssh before 0.5.3 allow remote attackers to cause a denial of service (crash) or possibly
CVE-2025-5372 HIGH
8.8 Jul 04

Cryptographic key derivation failure in libssh versions prior to 0.11.2 (when built against OpenSSL older than 3.0) can

CVE-2019-14889 HIGH
8.8 Dec 10

A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. Rated high severi
CVE-2025-5987 HIGH
8.1 Jul 07

A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library.
CVE-2015-3146 HIGH
7.5 Apr 13

The (1) SSH_MSG_NEWKEYS and (2) SSH_MSG_KEXDH_REPLY packet handlers in package_cb.c in libssh before 0.6.5 do not proper
CVE-2012-6063 HIGH
7.5 Nov 30

Double free vulnerability in the sftp_mkdir function in sftp.c in libssh before 0.5.3 allows remote attackers to cause a
CVE-2012-4559 MEDIUM
6.8 Nov 30

Multiple double free vulnerabilities in the (1) agent_sign_data function in agent.c, (2) channel_request function in cha
CVE-2016-0739 MEDIUM
5.9 Apr 13

libssh before 0.7.3 improperly truncates ephemeral secrets generated for the (1) diffie-hellman-group1 and (2) diffie-he

Same weakness CWE-121 – Stack-based Buffer Overflow

View all
CVE-2025-0282 CRITICAL POC
9.0
CVE-2025-22457 CRITICAL POC
9.8
CVE-2012-10060 CRITICAL POC
9.3
CVE-2012-10053 CRITICAL POC
9.3
CVE-2013-10064 CRITICAL POC
9.3
CVE-2012-10023 MEDIUM POC
6.9
CVE-2012-10058 CRITICAL POC
10.0
CVE-2013-10068 CRITICAL POC
9.4

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Micro 5.3 Not-Affected
SUSE Linux Enterprise Micro 5.4 Not-Affected
SUSE Linux Enterprise Micro 5.5 Not-Affected

Share

CVE-2026-15370 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy