GHSA-CR6P-6527-344M vulnerabilities

Vulnerabilities for packages: libssh...

CVE-2026-59842 vulnerabilities

Vulnerabilities for packages: libssh...

CVE-2026-59850 vulnerabilities

Vulnerabilities for packages: libssh...

GHSA-JP6G-7MQJ-WJ53 vulnerabilities

Vulnerabilities for packages: libssh...

GHSA-X5CR-V39M-53GW vulnerabilities

Vulnerabilities for packages: libssh...

...[ More ]

A proof of concept exploit for an authentication bypass vulnerability in libssh version 0.12.0. The vulnerability affects servers using GSSAPI key exchange and allows a client possessing a valid Kerberos ticket for any principal in the realm to authenticate as an arbitrary local user. The server...

Astra Linux – Vulnerability in libssh

A vulnerability has been identified in libssh up to version 0.11.3. The affected element is the function sftpextensionsgetname/sftpextensionsgetdata in the file src/sftp.c of the SFTP Extension Name Handler component. Performing operations on the argument idx can lead to out-of-bounds read...

Astra Linux – Vulnerability in libssh

A flaw was discovered in libssh. The API function sshgethexa is vulnerable to a denial-of-service attack when processing zero-length inputs. This vulnerability can be exploited remotely by an attacker during GSSAPI Generic Security Service Application Program Interface authentication, if the...

Astra Linux – Vulnerability in libssh

A flaw was discovered in libssh, where a malicious SFTP SSH File Transfer Protocol server can exploit this by sending a malformed ‘longname’ field within an SSHFXPNAME message during a file listing operation. This missing null check can lead to reading beyond the allocated memory on the heap. Thi...

Astra Linux – Vulnerability in libssh

A malicious SCP server can send unexpected commands that may cause the client application to override local files outside of the working directory. This could be exploited to create malicious executable or configuration files, causing the user to execute them with specific consequences. This is t...

Astra Linux – Vulnerability in curl

When performing SSH-based transfers using either SCP or SFTP, and setting the knownhosts file, libcurl may still mistakenly accept connections to hosts that are not present in the specified file, if those hosts are added as recognized in the libssh global knownhosts file...

Astra Linux – Vulnerability in libssh

A flaw was discovered in libssh. A remote attacker, by controlling client configuration files or knownhosts files, could create specific hostnames that, when processed by the matchpattern function, could lead to inefficient regular expression backtracking. This could cause timeouts and resource...

SUSE-SU-2026:23056-1 Security update for libssh

This update for libssh fixes the following issues: - CVE-2026-3731: denial of Service via out-of-bounds read in SFTP extension name handler bsc1259377. - CVE-2026-59843: denial of service via zero advertised channel packet size bsc1272164. - CVE-2026-59844: denial of service via oversized SFTP re...

Photon OS 5.0: Libssh PHSA-2024-5.0-91-0187

An update of the libssh package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-91-0187. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

SUSE SLES15 Security Update : libssh (SUSE-SU-2026:3463-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3463-1 advisory. - CVE-2026-59843: denial of service via zero advertised channel packet size bsc1272164. - CVE-2026-59844: denial of service via...

Security update for libssh

This update for libssh fixes the following issues: CVE-2026-59843: denial of service via zero advertised channel packet size bsc1272164. CVE-2026-59844: denial of service via oversized SFTP read length bsc1272165. CVE-2026-59845: denial of service via unchecked ProxyCommand fork failure bsc127216...

[SECURITY] [DSA 6410-1] libssh security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6410-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 02, 2026 https://www.debian.org/security/faq -...

Debian dsa-6410 : libssh-4 - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6410 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6410-1 [email protected] https://www.debian.org/securit...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: libssh: libssh-0.12.2-1.hum1 aarch64, x8664 libssh-config-0.12.2-1.hum1 noarch libssh-devel-0.12.2-1.hum1 aarch64, x8664 libssh-0.12.2-1.hum1.src src...

libssh: libssh: stack buffer overflow in SFTP server longname construction

A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list attacker-controlled filenames, sufficiently long names can overflow that stack buffer and may lead ...