libssh CVE-2026-59848

Exploitation requires the libssh-based client application to initiate an SFTP session with an attacker-controlled server. The victim must be using libssh (not OpenSSH's ssh/sftp binaries) for the SFTP operation. No authentication, elevated privileges, or non-default configuration on the victim system is required once the connection is established - the malicious server drives the attack entirely through crafted response packets. Limiting factors include: the attacker must control or impersonate the SFTP server endpoint the client connects to; exploitation is client-side only and does not pivot to other systems (S:U, unchanged scope); and the availability impact is partial (A:L), meaning memory exhaustion is gradual rather than instantaneous. Applications that only connect to hardcoded, trusted SFTP servers over authenticated channels are not practically exploitable even if the libssh version is vulnerable.

The CVSS 5.3 Medium score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) correctly categorises this as a network-reachable, low-complexity denial-of-service with limited availability impact. The critical nuance is directionality: the attacker must control the SFTP server, not the network path - the victim application initiates the connection to the malicious server. This substantially limits opportunistic exploitation; an attacker cannot scan the internet for libssh clients to attack directly. Real-world risk is highest for: applications that fetch files from user-supplied or untrusted SFTP endpoints, CI/CD pipelines connecting to dynamically provisioned SFTP backends, and managed-file-transfer scenarios where the server trust boundary is weak. No EPSS data was provided, and no KEV listing or POC code exists at time of analysis, suggesting no observed active exploitation. The low availability impact (A:L) further indicates partial rather than immediate process termination - memory pressure builds gradually, reducing urgency for emergency patching outside high-sensitivity environments.

An attacker operates a rogue SFTP server and induces a target application - such as a backup client, CI/CD pipeline, or file-transfer tool - to connect to it, either through DNS poisoning, BGP hijacking, misconfigured server URLs, or social engineering. Once the SFTP session is established, the server continuously returns response packets referencing request IDs that the libssh client never issued, causing the client's internal queue to grow without bound until the process exhausts available memory and crashes or becomes unresponsive. No public exploit code exists at time of analysis, but the attack logic is straightforward to implement given the description.