Skip to main content

libssh EUVDEUVD-2026-46179

| CVE-2026-59844 MEDIUM
Memory Allocation with Excessive Size Value (CWE-789)
2026-07-21 redhat GHSA-qp28-hpg5-j7xc
Information Disclosure Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Hardened Images
6.5
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
6.5 MEDIUM

Network-reachable SFTP server, no complexity, low-privilege auth required; purely availability impact via uncontrolled memory allocation.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
6.5 MEDIUM
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 21, 2026 - 12:31 vuln.today
CVE Published
Jul 21, 2026 - 11:32 nvd
MEDIUM 6.5

DescriptionCVE.org

A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests.

AnalysisAI

Memory exhaustion in libssh's SFTP server subsystem allows authenticated remote clients to degrade or crash the service by sending SSH_FXP_READ requests specifying an arbitrarily large read length, causing the server to allocate unbounded memory for each request. The CVSS vector (PR:L) confirms exploitation requires valid credentials, limiting the attack surface to authenticated SFTP users. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Obtain valid SSH credentials
Delivery
Authenticate to SFTP server
Exploit
Send SSH_FXP_READ with maximum length field
Install
Server allocates excessive memory per request
C2
Repeat requests rapidly
Execute
Exhaust server memory
Impact
SFTP service denial
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The attacker must hold valid SSH credentials with SFTP subsystem access on the targeted system (CVSS PR:L confirms low-privilege authentication is required, not unauthenticated access). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 6.5 Medium rating reflects a network-accessible availability attack requiring low privileges (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with valid SSH credentials on an RHEL system running libssh as an SFTP server connects and issues a sequence of SSH_FXP_READ requests each specifying a maximally large length value. The server allocates memory for each request without bounding the requested size; by repeating this in a tight loop the attacker progressively exhausts available system memory, causing the SFTP service - and potentially co-resident services - to become unavailable. …
Remediation Apply the vendor-released patch via Red Hat's standard update mechanism (yum/dnf update libssh) once a fixed package is published for the affected RHEL version; consult https://access.redhat.com/security/cve/CVE-2026-59844 for the current patch status and exact fixed package version. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Red Hat Enterprise Linux 10

View all
CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-28369 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel

CVE-2026-28368 CRITICAL
9.1 Mar 27

HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
CVE-2026-33845 CRITICAL
9.1 Apr 30

Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
CVE-2026-28367 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
CVE-2026-16526 HIGH
8.8 Jul 30

Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
CVE-2026-11610 HIGH
8.8 Jul 07

Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD
CVE-2026-14474 HIGH
8.8 Jul 07

Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user

CVE-2026-52720 HIGH
8.8 Jun 15

Heap buffer overflow in GStreamer's librfb (RFB/VNC client) allows a malicious VNC server to corrupt heap memory on a co
CVE-2026-59851 HIGH
8.8 Jul 21

Privilege escalation via authentication bypass in libssh affects servers that enable GSSAPIKeyExchange, where the gssapi

Same weakness CWE-789 – Memory Allocation with Excessive Size Value

View all
CVE-2026-59204 HIGH POC
8.7
CVE-2018-25368 HIGH POC
8.7
CVE-2021-47973 HIGH POC
8.7
CVE-2021-47972 HIGH POC
8.7
CVE-2021-47971 HIGH POC
8.7
CVE-2021-47970 HIGH POC
8.7
CVE-2021-47969 HIGH POC
8.7
CVE-2021-47944 HIGH POC
8.7

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2023-4966 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

Share

EUVD-2026-46179 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy