libssh CVE-2026-59844

The attacker must hold valid SSH credentials with SFTP subsystem access on the targeted system (CVSS PR:L confirms low-privilege authentication is required, not unauthenticated access). The vulnerable code path is the libssh SFTP server subsystem, so the server must be configured to offer SFTP service (the default in most RHEL deployments using sshd with the internal-sftp subsystem). No non-default configuration is required to be vulnerable - standard SFTP-enabled sshd deployments using libssh are at risk. Exploitation is limited by the authentication requirement: unauthenticated remote attackers cannot reach the vulnerable path. Scope is unchanged (S:U), so the impact is confined to the targeted server process and its memory space rather than affecting adjacent systems directly.

The CVSS 6.5 Medium rating reflects a network-accessible availability attack requiring low privileges (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Real-world risk is moderate: exploitation is constrained to authenticated SFTP users, which substantially narrows the attacker population compared to pre-auth vulnerabilities. However, any user with valid SSH credentials and SFTP access - including compromised accounts or malicious insiders - could trigger service disruption with no special technical skill. Low attack complexity (AC:L) means the attack is straightforward once credentials are held. No EPSS data was provided; no KEV listing and no public POC exist at time of analysis, suggesting this has not seen broad opportunistic exploitation. The sole impact is availability (C:N/I:N), so there is no data exfiltration or integrity risk. The 'Information Disclosure' tag in the source data appears misapplied and conflicts with the CVSS impact vector - treat it as a tagging error. Priority is elevated for environments where libssh is used as a public-facing SFTP server with broad user bases.

An attacker with valid SSH credentials on an RHEL system running libssh as an SFTP server connects and issues a sequence of SSH_FXP_READ requests each specifying a maximally large length value. The server allocates memory for each request without bounding the requested size; by repeating this in a tight loop the attacker progressively exhausts available system memory, causing the SFTP service - and potentially co-resident services - to become unavailable. No public POC has been identified, but the attack requires only standard SFTP client tooling and knowledge of the SSH_FXP_READ message format.