Every CVE Search/ Get API key

CVE-2026-0968

Libssh: libssh: denial of service due to malformed sftp message

3.1 LowFix available

A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an SSH_FXP_NAME message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can cause unexpected behavior or lead to a denial of service (DoS) due to application crashes.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.46%Up 0.4 points since Mar 27, 2026
90%50%10%1%

What each source reports

CVE List Score used 3.1

Libssh: libssh: denial of service due to malformed sftp message

A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an SSH_FXP_NAME message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can cause unexpected behavior or lead to a denial of service (DoS) due to application crashes.

Record
CVE-2026-0968
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Weakness
CWE-476
Updated
2026-11-06
EUVDEUVD-2026-16335 3.1

A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an SSH_FXP_NAME message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can cause unexpected behavior or lead to a denial of service (DoS) due to application crashes.

Record
EUVD-2026-16335
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Updated
2026-11-06
GitHub AdvisoriesGHSA-6w3m-r3qq-cr2h 3.1

A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can...

A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an SSH_FXP_NAME message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can cause unexpected behavior or lead to a denial of service (DoS) due to application crashes.

Record
GHSA-6w3m-r3qq-cr2h
CVSS 3.0
3.1 LowCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Weakness
CWE-476
Updated
2026-11-02
NVD 3.1

A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an SSH_FXP_NAME message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can cause unexpected behavior or lead to a denial of service (DoS) due to application crashes.

Record
CVE-2026-0968
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Weakness
CWE-476
Updated
2026-11-06
OSVALPINE-CVE-2026-0968 3.1

A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an SSH_FXP_NAME message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can cause unexpected behavior or lead to a denial of service (DoS) due to application crashes.

Record
ALPINE-CVE-2026-0968
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Updated
2026-11-03
OSVBELL-CVE-2026-0968 3.1
Record
BELL-CVE-2026-0968
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Updated
2026-11-02
Show 38 moreShow less
OSV 3.1

Libssh: libssh: denial of service due to malformed sftp message

A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an SSH_FXP_NAME message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can cause unexpected behavior or lead to a denial of service (DoS) due to application crashes.

Record
CVE-2026-0968
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Weakness
CWE-476
Updated
2026-11-07
OSVDEBIAN-CVE-2026-0968 3.1

A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an SSH_FXP_NAME message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can cause unexpected behavior or lead to a denial of service (DoS) due to application crashes.

Record
DEBIAN-CVE-2026-0968
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Updated
2026-11-07
OSVJLSEC-2026-783 3.1

A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an SSH_FXP_NAME message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can cause unexpected behavior or lead to a denial of service (DoS) due to application crashes.

Record
JLSEC-2026-783
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2026-1558 6.5

libssh security update

The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote programs. With its Secure FTP implementation, you can play with remote files easily, without third-party programs others than libcrypto (from openssl).

Security Fix(es):

(CVE-2026-0964)

(CVE-2026-0965)

(CVE-2026-0966)

(CVE-2026-0967)

(CVE-2026-0968)

Record
OESA-2026-1558
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVOESA-2026-1559 6.5

libssh security update

The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote programs. With its Secure FTP implementation, you can play with remote files easily, without third-party programs others than libcrypto (from openssl).

Security Fix(es):

(CVE-2026-0964)

(CVE-2026-0965)

(CVE-2026-0966)

(CVE-2026-0967)

(CVE-2026-0968)

Record
OESA-2026-1559
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVOESA-2026-1560 9.8

libssh security update

The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote programs. With its Secure FTP implementation, you can play with remote files easily, without third-party programs others than libcrypto (from openssl).

Security Fix(es):

(CVE-2026-0964)

(CVE-2026-0965)

(CVE-2026-0966)

(CVE-2026-0967)

(CVE-2026-0968)

A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component.(CVE-2026-3731)

Record
OESA-2026-1560
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-1561 6.5

libssh security update

The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote programs. With its Secure FTP implementation, you can play with remote files easily, without third-party programs others than libcrypto (from openssl).

Security Fix(es):

(CVE-2026-0964)

(CVE-2026-0965)

(CVE-2026-0966)

(CVE-2026-0967)

(CVE-2026-0968)

Record
OESA-2026-1561
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVOESA-2026-1562 6.5

libssh security update

The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote programs. With its Secure FTP implementation, you can play with remote files easily, without third-party programs others than libcrypto (from openssl).

Security Fix(es):

(CVE-2026-0964)

(CVE-2026-0965)

(CVE-2026-0966)

(CVE-2026-0967)

(CVE-2026-0968)

Record
OESA-2026-1562
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVOESA-2026-1563 6.5

libssh security update

The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote programs. With its Secure FTP implementation, you can play with remote files easily, without third-party programs others than libcrypto (from openssl).

Security Fix(es):

(CVE-2026-0965)

(CVE-2026-0966)

(CVE-2026-0968)

Record
OESA-2026-1563
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVRHSA-2026:18160 6.5

Red Hat Security Advisory: libssh security update

Record
RHSA-2026:18160
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSVRHSA-2026:18683 6.5

Red Hat Security Advisory: libssh security update

Record
RHSA-2026:18683
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSVRLSA-2026:18160 6.5

Moderate: libssh security update

libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.

Security Fix(es):

  • libssh: Buffer underflow in ssh_get_hexa() on invalid input (CVE-2026-0966)

  • libssh: Improper sanitation of paths received from SCP servers (CVE-2026-0964)

  • libssh: libssh: Denial of Service via improper configuration file handling (CVE-2026-0965)

  • libssh: libssh: Denial of Service via inefficient regular expression processing (CVE-2026-0967)

  • libssh: libssh: Denial of Service due to malformed SFTP message (CVE-2026-0968)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.

Record
RLSA-2026:18160
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSVRLSA-2026:18683 6.5

Moderate: libssh security update

libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.

Security Fix(es):

  • libssh: Double Free Vulnerability in libssh Key Export Functions (CVE-2025-5351)

  • libssh: Use of uninitialized variable in privatekey_from_file() (CVE-2025-4878)

  • libssh: Write beyond bounds in binary to base64 conversion functions (CVE-2025-4877)

  • libssh: NULL Pointer Dereference in libssh KEX Session ID Calculation (CVE-2025-8114)

  • libssh: Memory Exhaustion via Repeated Key Exchange in libssh (CVE-2025-8277)

  • libssh: Buffer underflow in ssh_get_hexa() on invalid input (CVE-2026-0966)

  • libssh: Improper sanitation of paths received from SCP servers (CVE-2026-0964)

  • libssh: libssh: Denial of Service via improper configuration file handling (CVE-2026-0965)

  • libssh: libssh: Denial of Service via inefficient regular expression processing (CVE-2026-0967)

  • libssh: libssh: Denial of Service due to malformed SFTP message (CVE-2026-0968)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.

Record
RLSA-2026:18683
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-0968 3.1

A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an SSH_FXP_NAME message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can cause unexpected behavior or lead to a denial of service (DoS) due to application crashes.

Record
UBUNTU-CVE-2026-0968
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
CVSS 3.0
3.1 LowCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVALSA-2026:18160 No score

Moderate: libssh security update

libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.

Security Fix(es):

  • libssh: Buffer underflow in ssh_get_hexa() on invalid input (CVE-2026-0966)
  • libssh: Improper sanitation of paths received from SCP servers (CVE-2026-0964)
  • libssh: libssh: Denial of Service via improper configuration file handling (CVE-2026-0965)
  • libssh: libssh: Denial of Service via inefficient regular expression processing (CVE-2026-0967)
  • libssh: libssh: Denial of Service due to malformed SFTP message (CVE-2026-0968)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2026:18160
Updated
2026-11-02
OSVALSA-2026:18683 No score

Moderate: libssh security update

libssh is a library which implements the SSH protocol. It can be used to implement client and server applications.

Security Fix(es):

  • libssh: Double Free Vulnerability in libssh Key Export Functions (CVE-2025-5351)
  • libssh: Use of uninitialized variable in privatekey_from_file() (CVE-2025-4878)
  • libssh: Write beyond bounds in binary to base64 conversion functions (CVE-2025-4877)
  • libssh: NULL Pointer Dereference in libssh KEX Session ID Calculation (CVE-2025-8114)
  • libssh: Memory Exhaustion via Repeated Key Exchange in libssh (CVE-2025-8277)
  • libssh: Buffer underflow in ssh_get_hexa() on invalid input (CVE-2026-0966)
  • libssh: Improper sanitation of paths received from SCP servers (CVE-2026-0964)
  • libssh: libssh: Denial of Service via improper configuration file handling (CVE-2026-0965)
  • libssh: libssh: Denial of Service via inefficient regular expression processing (CVE-2026-0967)
  • libssh: libssh: Denial of Service due to malformed SFTP message (CVE-2026-0968)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section.

Record
ALSA-2026:18683
Updated
2026-11-02
OSVAZL-81849 No score

CVE-2026-0968 affecting package libssh for versions less than 0.10.6-8

A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an SSH_FXP_NAME message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can cause unexpected behavior or lead to a denial of service (DoS) due to application crashes.

Record
AZL-81849
Updated
2026-11-05
OSVCLSA-2026-1776178207 No score

libssh: Fix of CVE-2026-0968

  • CVE-2026-0968: sftp_parse_longname out-of-bounds access
Record
CLSA-2026-1776178207
Updated
2026-11-02
OSVCLSA-2026-1776181240 No score

libssh: Fix of CVE-2026-0968

  • Fix CVE-2026-0968 - sftp_parse_longname out-of-bounds access
Record
CLSA-2026-1776181240
Updated
2026-11-02
OSVCLSA-2026-1776262694 No score

Fix CVE(s): CVE-2026-0968

  • SECURITY UPDATE: null pointer dereference and out-of-bounds read in sftp_parse_longname when processing malformed SSH_FXP_NAME messages
    • debian/patches/CVE-2026-0968.patch: add null check, input validation, and end-of-string guards in sftp_parse_longname
    • CVE-2026-0968
Record
CLSA-2026-1776262694
Updated
2026-11-02
OSVCLSA-2026-1776361748 No score

Fix CVE(s): CVE-2026-0968

  • SECURITY UPDATE: heap read past bounds in sftp_parse_longname from malicious SFTP longname field
    • debian/patches/CVE-2026-0968.patch: validate longname pointer and longname_field; bound string walks at NUL; fail if field not found
    • CVE-2026-0968
Record
CLSA-2026-1776361748
Updated
2026-11-02
OSVCLSA-2026-1776362968 No score

Fix CVE(s): CVE-2026-0968

  • SECURITY UPDATE: heap read past bounds in sftp_parse_longname from malicious SFTP longname field
    • debian/patches/CVE-2026-0968.patch: validate longname pointer and longname_field; bound string walks at NUL; fail if field not found
    • CVE-2026-0968
Record
CLSA-2026-1776362968
Updated
2026-11-02
OSVCLSA-2026-1776701249 No score

libssh: Fix of CVE-2026-0968

  • CVE-2026-0968: sanitize input handling in sftp_parse_longname() to prevent OOB read when processing malformed SFTP longname fields, add unit tests
Record
CLSA-2026-1776701249
Updated
2026-11-02
OSVCLSA-2026-1776703400 No score

libssh: Fix of CVE-2026-0968

  • CVE-2026-0968: sanitize input handling in sftp_parse_longname() to prevent OOB read when processing malformed SFTP longname fields, add unit tests
Record
CLSA-2026-1776703400
Updated
2026-11-02
OSVCLSA-2026-1776705065 No score

libssh: Fix of CVE-2026-0968

  • CVE-2026-0968: sanitize input handling in sftp_parse_longname() to prevent OOB read when processing malformed SFTP longname fields, add unit tests
Record
CLSA-2026-1776705065
Updated
2026-11-02
OSVMGASA-2026-0202 No score

Updated libssh packages fix security vulnerabilities

CVE-2026-0964 Improper sanitation of paths received from SCP servers CVE-2026-0965 The libssh can attempt to read non-regular files when misconfigured, which could cause resource exhaustion or blocking. CVE-2026-0966 Providing 0-length input for the ssh_get_hexa() causes 1-byte buffer underflow on heap, possibly causing memory corruption. CVE-2026-0967 Pattern matching at various places in libssh could lead to complex backtracking causing timeouts. CVE-2026-0968 Possible read behind bounds of longname

Record
MGASA-2026-0202
Updated
2026-11-02
OSVopenSUSE-SU-2026:10203-1 No score

libssh-config-0.11.4-1.1 on GA media

These are all security issues fixed in the libssh-config-0.11.4-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10203-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20647-1 No score

Security update for libssh

This update for libssh fixes the following issues:

  • Update to version 0.11.4:
  • CVE-2026-0964: SCP Protocol Path Traversal in ssh_scp_pull_request() (bsc#1258049)
  • CVE-2026-0965: Possible Denial of Service when parsing unexpected configuration files (bsc#1258045)
  • CVE-2026-0966: Buffer underflow in ssh_get_hexa() on invalid input (bsc#1258054)
  • CVE-2026-0967: Specially crafted patterns could cause DoS (bsc#1258081)
  • CVE-2026-0968: OOB Read in sftp_parse_longname() (bsc#1258080)
  • CVE-2025-8114: Fix NULL pointer dereference after allocation failure (bsc#1246974)
  • CVE-2025-8277: Fix memory leak of ephemeral key pair during repeated wrong KEX (bsc#1249375)
Record
openSUSE-SU-2026:20647-1
Updated
2026-11-02
OSVSUSE-SU-2026:0567-1 No score

Security update for libssh

This update for libssh fixes the following issues:

  • CVE-2026-0964: improper sanitation of paths received from SCP servers can cause path traversal (bsc#1258049).
  • CVE-2026-0965: possible denial of service when parsing unexpected configuration files (bsc#1258045).
  • CVE-2026-0966: buffer underflow in ssh_get_hexa() on invalid input (bsc#1258054).
  • CVE-2026-0967: specially crafted patterns could cause denial of service (bsc#1258081).
  • CVE-2026-0968: malformed SFTP message can lead to out of bound read (bsc#1258080).
Record
SUSE-SU-2026:0567-1
Updated
2026-11-02
OSVSUSE-SU-2026:0778-1 No score

Security update for libssh

This update for libssh fixes the following issues:

  • CVE-2026-0964: improper sanitation of paths received from SCP servers can cause path traversal (bsc#1258049).
  • CVE-2026-0965: possible denial of service when parsing unexpected configuration files (bsc#1258045).
  • CVE-2026-0966: buffer underflow in ssh_get_hexa() on invalid input (bsc#1258054).
  • CVE-2026-0967: specially crafted patterns could cause denial of service (bsc#1258081).
  • CVE-2026-0968: malformed SFTP message can lead to out of bound read (bsc#1258080).
Record
SUSE-SU-2026:0778-1
Updated
2026-11-02
OSVSUSE-SU-2026:0779-1 No score

Security update for libssh

This update for libssh fixes the following issues:

  • CVE-2026-0964: improper sanitation of paths received from SCP servers can cause path traversal (bsc#1258049).
  • CVE-2026-0965: possible denial of service when parsing unexpected configuration files (bsc#1258045).
  • CVE-2026-0966: buffer underflow in ssh_get_hexa() on invalid input (bsc#1258054).
  • CVE-2026-0967: specially crafted patterns could cause denial of service (bsc#1258081).
  • CVE-2026-0968: malformed SFTP message can lead to out of bound read (bsc#1258080).
Record
SUSE-SU-2026:0779-1
Updated
2026-11-02
OSVSUSE-SU-2026:1344-1 No score

Security update for libssh

This update for libssh fixes the following issues:

  • CVE-2026-3731: denial of service via out-of-bounds read in SFTP extension name handler (bsc#1259377).
  • CVE-2026-0964: SCP protocol path traversal in ssh_scp_pull_request() (bsc#1258049).
  • CVE-2026-0965: possible denial of service when parsing unexpected configuration files (bsc#1258045).
  • CVE-2026-0966: buffer underflow in ssh_get_hexa() on invalid input (bsc#1258054).
  • CVE-2026-0967: specially crafted patterns could cause a denial of service (bsc#1258081).
  • CVE-2026-0968: out-of-bounds read in sftp_parse_longname() (bsc#1258080).
Record
SUSE-SU-2026:1344-1
Updated
2026-11-02
OSVSUSE-SU-2026:1565-1 No score

Security update for libssh

This update for libssh fixes the following issues:

  • CVE-2026-0964: improper sanitation of paths received from SCP servers can cause path traversal (bsc#1258049).
  • CVE-2026-0965: possible denial of service when parsing unexpected configuration files (bsc#1258045).
  • CVE-2026-0966: buffer underflow in ssh_get_hexa() on invalid input (bsc#1258054).
  • CVE-2026-0967: specially crafted patterns could cause denial of service (bsc#1258081).
  • CVE-2026-0968: malformed SFTP message can lead to out of bound read (bsc#1258080).
  • CVE-2026-3731: denial of service via out-of-bounds read in SFTP extension name handler (bsc#1259377).
Record
SUSE-SU-2026:1565-1
Updated
2026-11-02
OSVSUSE-SU-2026:20524-1 No score

Security update for libssh

This update for libssh fixes the following issues:

  • CVE-2026-0964: SCP Protocol Path Traversal in ssh_scp_pull_request() (bsc#1258049)
  • CVE-2026-0965: Possible Denial of Service when parsing unexpected configuration files (bsc#1258045)
  • CVE-2026-0966: Buffer underflow in ssh_get_hexa() on invalid input (bsc#1258054)
  • CVE-2026-0967: Specially crafted patterns could cause DoS (bsc#1258081)
  • CVE-2026-0968: OOB Read in sftp_parse_longname() (bsc#1258080)
Record
SUSE-SU-2026:20524-1
Updated
2026-11-02
OSVSUSE-SU-2026:20531-1 No score

Security update for libssh

This update for libssh fixes the following issues:

  • CVE-2026-0964: improper sanitation of paths received from SCP servers can cause path traversal (bsc#1258049).
  • CVE-2026-0965: possible denial of service when parsing unexpected configuration files (bsc#1258045).
  • CVE-2026-0966: buffer underflow in ssh_get_hexa() on invalid input (bsc#1258054).
  • CVE-2026-0967: specially crafted patterns could cause denial of service (bsc#1258081).
  • CVE-2026-0968: malformed SFTP message can lead to out of bound read (bsc#1258080).
Record
SUSE-SU-2026:20531-1
Updated
2026-11-02
OSVSUSE-SU-2026:21396-1 No score

Security update for libssh

This update for libssh fixes the following issues:

  • Update to version 0.11.4:
  • CVE-2026-0964: SCP Protocol Path Traversal in ssh_scp_pull_request() (bsc#1258049)
  • CVE-2026-0965: Possible Denial of Service when parsing unexpected configuration files (bsc#1258045)
  • CVE-2026-0966: Buffer underflow in ssh_get_hexa() on invalid input (bsc#1258054)
  • CVE-2026-0967: Specially crafted patterns could cause DoS (bsc#1258081)
  • CVE-2026-0968: OOB Read in sftp_parse_longname() (bsc#1258080)
  • CVE-2025-8114: Fix NULL pointer dereference after allocation failure (bsc#1246974)
  • CVE-2025-8277: Fix memory leak of ephemeral key pair during repeated wrong KEX (bsc#1249375)
Record
SUSE-SU-2026:21396-1
Updated
2026-11-02
OSVSUSE-SU-2026:21428-1 No score

Security update for libssh

This update for libssh fixes the following issues:

  • Update to version 0.11.4:
  • CVE-2026-0964: SCP Protocol Path Traversal in ssh_scp_pull_request() (bsc#1258049)
  • CVE-2026-0965: Possible Denial of Service when parsing unexpected configuration files (bsc#1258045)
  • CVE-2026-0966: Buffer underflow in ssh_get_hexa() on invalid input (bsc#1258054)
  • CVE-2026-0967: Specially crafted patterns could cause DoS (bsc#1258081)
  • CVE-2026-0968: OOB Read in sftp_parse_longname() (bsc#1258080)
  • CVE-2025-8114: Fix NULL pointer dereference after allocation failure (bsc#1246974)
  • CVE-2025-8277: Fix memory leak of ephemeral key pair during repeated wrong KEX (bsc#1249375)
Record
SUSE-SU-2026:21428-1
Updated
2026-11-02
OSVUSN-8051-1 No score

libssh vulnerabilities

It was discovered that libssh clients incorrectly handled the key exchange process. A remote attacker could possibly use this issue to cause libssh clients to crash, resulting in a denial of service. (CVE-2025-8277)

It was discovered that the libssh SCP client incorrectly sanitized paths received from servers. A remote attacker could use this issue to cause libssh SCP clients to overwrite files outside of the working directory and possibly execute arbitrary code. (CVE-2026-0964)

It was discovered that libssh incorrectly handled parsing configuration files. A local attacker could possibly use this issue to cause libssh to access non-regular files, resulting in a denial of service. (CVE-2026-0965)

It was discovered that libssh incorrectly handled the ssh_get_hexa() function. A remote attacker could possibly use this issue to cause libssh to crash, resulting in a denial of service. (CVE-2026-0966)

It was discovered that libssh incorrectly handled certain regular expressions. A local attacker could possibly use this issue to cause libssh to consume resources, resulting in a denial of service. (CVE-2026-0967)

It was discovered that the libssh SFTP client incorrectly handled certain malformed longname fields. A remote attacker could use this issue to cause libssh SFTP clients to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-0968)

Record
USN-8051-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libssh
Alpine:v3.23
 before 0.11.4-r0
0.11.4-r0
libssh
Alpine:v3.24
 before 0.12.0-r0
0.12.0-r0
libssh
AlmaLinux:10
From an advisory covering 5 CVEs
 before 0.12.0-2.el10
0.12.0-2.el10
libssh-config
AlmaLinux:10
From an advisory covering 5 CVEs
 before 0.12.0-2.el10
0.12.0-2.el10
libssh-devel
AlmaLinux:10
From an advisory covering 5 CVEs
 before 0.12.0-2.el10
0.12.0-2.el10
libssh
AlmaLinux:9
From an advisory covering 10 CVEs
 before 0.10.4-18.el9
0.10.4-18.el9
libssh-config
AlmaLinux:9
From an advisory covering 10 CVEs
 before 0.10.4-18.el9
0.10.4-18.el9
libssh-devel
AlmaLinux:9
From an advisory covering 10 CVEs
 before 0.10.4-18.el9
0.10.4-18.el9
libssh
Azure Linux:3
 before 0.10.6-8
0.10.6-8
libssh
Alpaquita:23
 0.10.4-r0 up to 0.11.4-r0
0.11.4-r0
Show 77 moreShow less
Affected packages
PackageAffectedFixed
libssh
Alpaquita:25
 0.11.1-r0 up to 0.11.4-r0
0.11.4-r0
libssh
Alpaquita:stream
 0.9.6-r1 up to 0.11.4-r0
0.11.4-r0
libssh
TuxCare:AlmaLinux:9.6
 before 0.10.4-15.el9_6.tuxcare.els4
0.10.4-15.el9_6.tuxcare.els4
libssh-config
TuxCare:AlmaLinux:9.6
 before 0.10.4-15.el9_6.tuxcare.els4
0.10.4-15.el9_6.tuxcare.els4
libssh-devel
TuxCare:AlmaLinux:9.6
 before 0.10.4-15.el9_6.tuxcare.els4
0.10.4-15.el9_6.tuxcare.els4
libssh
TuxCare:AlmaLinux:9.2
 before 0.10.4-8.el9.tuxcare.els8
0.10.4-8.el9.tuxcare.els8
libssh-config
TuxCare:AlmaLinux:9.2
 before 0.10.4-8.el9.tuxcare.els8
0.10.4-8.el9.tuxcare.els8
libssh-devel
TuxCare:AlmaLinux:9.2
 before 0.10.4-8.el9.tuxcare.els8
0.10.4-8.el9.tuxcare.els8
libssh-4
TuxCare:Ubuntu:20.04
 before 0.9.3-2ubuntu2.5+tuxcare.els4
0.9.3-2ubuntu2.5+tuxcare.els4
libssh-dev
TuxCare:Ubuntu:20.04
 before 0.9.3-2ubuntu2.5+tuxcare.els4
0.9.3-2ubuntu2.5+tuxcare.els4
libssh-doc
TuxCare:Ubuntu:20.04
 before 0.9.3-2ubuntu2.5+tuxcare.els4
0.9.3-2ubuntu2.5+tuxcare.els4
libssh-gcrypt-4
TuxCare:Ubuntu:20.04
 before 0.9.3-2ubuntu2.5+tuxcare.els4
0.9.3-2ubuntu2.5+tuxcare.els4
libssh-gcrypt-dev
TuxCare:Ubuntu:20.04
 before 0.9.3-2ubuntu2.5+tuxcare.els4
0.9.3-2ubuntu2.5+tuxcare.els4
libssh-4
TuxCare:Ubuntu:16.04
 before 0.6.3-4.3ubuntu0.6+tuxcare.els4
0.6.3-4.3ubuntu0.6+tuxcare.els4
libssh-dev
TuxCare:Ubuntu:16.04
 before 0.6.3-4.3ubuntu0.6+tuxcare.els4
0.6.3-4.3ubuntu0.6+tuxcare.els4
libssh-doc
TuxCare:Ubuntu:16.04
 before 0.6.3-4.3ubuntu0.6+tuxcare.els4
0.6.3-4.3ubuntu0.6+tuxcare.els4
libssh-gcrypt-4
TuxCare:Ubuntu:16.04
 before 0.6.3-4.3ubuntu0.6+tuxcare.els4
0.6.3-4.3ubuntu0.6+tuxcare.els4
libssh-gcrypt-dev
TuxCare:Ubuntu:16.04
 before 0.6.3-4.3ubuntu0.6+tuxcare.els4
0.6.3-4.3ubuntu0.6+tuxcare.els4
libssh-4
TuxCare:Ubuntu:18.04
 before 0.8.0~20170825.94fa1e38-1ubuntu0.7+tuxcare.els4
0.8.0~20170825.94fa1e38-1ubuntu0.7+tuxcare.els4
libssh-dev
TuxCare:Ubuntu:18.04
 before 0.8.0~20170825.94fa1e38-1ubuntu0.7+tuxcare.els4
0.8.0~20170825.94fa1e38-1ubuntu0.7+tuxcare.els4
libssh-doc
TuxCare:Ubuntu:18.04
 before 0.8.0~20170825.94fa1e38-1ubuntu0.7+tuxcare.els4
0.8.0~20170825.94fa1e38-1ubuntu0.7+tuxcare.els4
libssh-gcrypt-4
TuxCare:Ubuntu:18.04
 before 0.8.0~20170825.94fa1e38-1ubuntu0.7+tuxcare.els4
0.8.0~20170825.94fa1e38-1ubuntu0.7+tuxcare.els4
libssh-gcrypt-dev
TuxCare:Ubuntu:18.04
 before 0.8.0~20170825.94fa1e38-1ubuntu0.7+tuxcare.els4
0.8.0~20170825.94fa1e38-1ubuntu0.7+tuxcare.els4
libssh
TuxCare:CentOS:8.4
 before 0.9.4-3.el8.tuxcare.els8
0.9.4-3.el8.tuxcare.els8
libssh-config
TuxCare:CentOS:8.4
 before 0.9.4-3.el8.tuxcare.els8
0.9.4-3.el8.tuxcare.els8
libssh-devel
TuxCare:CentOS:8.4
 before 0.9.4-3.el8.tuxcare.els8
0.9.4-3.el8.tuxcare.els8
libssh
TuxCare:CentOS:8.5
 before 0.9.4-3.el8.tuxcare.els8
0.9.4-3.el8.tuxcare.els8
libssh-config
TuxCare:CentOS:8.5
 before 0.9.4-3.el8.tuxcare.els8
0.9.4-3.el8.tuxcare.els8
libssh-devel
TuxCare:CentOS:8.5
 before 0.9.4-3.el8.tuxcare.els8
0.9.4-3.el8.tuxcare.els8
libssh
TuxCare:CentOS-Stream:8
 before 0.9.6-14.el8.tuxcare.els4
0.9.6-14.el8.tuxcare.els4
libssh-config
TuxCare:CentOS-Stream:8
 before 0.9.6-14.el8.tuxcare.els4
0.9.6-14.el8.tuxcare.els4
libssh-devel
TuxCare:CentOS-Stream:8
 before 0.9.6-14.el8.tuxcare.els4
0.9.6-14.el8.tuxcare.els4
libssh
Debian:12
 before 0.10.6-0+deb12u3, plus listed versions
0.10.5-20.10.5-30.10.5-3+hurd.10.10.6-0+deb12u10.10.6-0+deb12u2
0.10.6-0+deb12u3
libssh
Debian:13
 before 0.11.5-0+deb13u1, plus listed versions
0.11.2-10.11.2-1+deb13u10.11.3-1
0.11.5-0+deb13u1
libssh
Debian:14
 before 0.12.0-1, plus listed versions
0.11.2-10.11.3-1
0.12.0-1
libssh_jll
Julia
 before 0.11.4+0
0.11.4+0
libssh
Mageia:9
From an advisory covering 5 CVEs
 before 0.10.6-1.2.mga9
0.10.6-1.2.mga9
libssh
openEuler:24.03-LTS-SP1
From an advisory covering 5 CVEs
 before 0.10.5-9.oe2403sp1
0.10.5-9.oe2403sp1
libssh
openEuler:24.03-LTS-SP2
From an advisory covering 5 CVEs
 before 0.10.5-9.oe2403sp2
0.10.5-9.oe2403sp2
libssh
openEuler:24.03-LTS-SP3
From an advisory covering 6 CVEs
 before 0.10.5-10.oe2403sp3
0.10.5-10.oe2403sp3
libssh
openEuler:20.03-LTS-SP4
From an advisory covering 5 CVEs
 before 0.9.4-15.oe2003sp4
0.9.4-15.oe2003sp4
libssh
openEuler:22.03-LTS-SP4
From an advisory covering 5 CVEs
 before 0.9.6-15.oe2203sp4
0.9.6-15.oe2203sp4
libssh
openEuler:24.03-LTS
From an advisory covering 3 CVEs
 before 0.10.5-9.oe2403
0.10.5-9.oe2403
libssh-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 5 CVEs
 before 0:0.12.0-2.el10
0:0.12.0-2.el10
libssh-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 5 CVEs
 before 0:0.12.0-2.el10
0:0.12.0-2.el10
libssh-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 5 CVEs
 before 0:0.12.0-2.el10
0:0.12.0-2.el10
libssh
Red Hat:enterprise_linux:10.2
From an advisory covering 5 CVEs
 before 0:0.12.0-2.el10
0:0.12.0-2.el10
libssh-config
Red Hat:enterprise_linux:10.2
From an advisory covering 5 CVEs
 before 0:0.12.0-2.el10
0:0.12.0-2.el10
libssh-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 0:0.10.4-18.el9
0:0.10.4-18.el9
libssh-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 0:0.10.4-18.el9
0:0.10.4-18.el9
libssh-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 0:0.10.4-18.el9
0:0.10.4-18.el9
libssh
Red Hat:enterprise_linux:9::baseos
From an advisory covering 10 CVEs
 before 0:0.10.4-18.el9
0:0.10.4-18.el9
libssh-config
Red Hat:enterprise_linux:9::baseos
From an advisory covering 10 CVEs
 before 0:0.10.4-18.el9
0:0.10.4-18.el9
libssh-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 10 CVEs
 before 0:0.10.4-18.el9
0:0.10.4-18.el9
libssh-debugsource
Red Hat:enterprise_linux:9::baseos
From an advisory covering 10 CVEs
 before 0:0.10.4-18.el9
0:0.10.4-18.el9
libssh
Rocky Linux:10
From an advisory covering 5 CVEs
 before 0:0.12.0-2.el10
0:0.12.0-2.el10
libssh
Rocky Linux:9
From an advisory covering 10 CVEs
 before 0:0.10.4-18.el9
0:0.10.4-18.el9
libssh
SUSE:Linux Enterprise Micro 5.2
From an advisory covering 5 CVEs
 before 0.9.8-150200.13.15.1
0.9.8-150200.13.15.1
libssh
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 5 CVEs
 before 0.9.8-3.21.1
0.9.8-3.21.1
libssh
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 5 CVEs
 before 0.9.8-150600.11.9.1
0.9.8-150600.11.9.1
libssh
openSUSE:Leap 15.6
From an advisory covering 5 CVEs
 before 0.9.8-150600.11.9.1
0.9.8-150600.11.9.1
libssh
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 6 CVEs
 before 0.6.3-12.28.1
0.6.3-12.28.1
libssh
SUSE:Linux Enterprise Micro 5.3
From an advisory covering 6 CVEs
 before 0.9.8-150400.3.17.1
0.9.8-150400.3.17.1
libssh
SUSE:Linux Enterprise Micro 5.4
From an advisory covering 6 CVEs
 before 0.9.8-150400.3.17.1
0.9.8-150400.3.17.1
libssh
SUSE:Linux Enterprise Micro 5.5
From an advisory covering 6 CVEs
 before 0.9.8-150400.3.17.1
0.9.8-150400.3.17.1
libssh
SUSE:Linux Micro 6.0
From an advisory covering 5 CVEs
 before 0.10.6-4.1
0.10.6-4.1
libssh
SUSE:Linux Micro 6.1
From an advisory covering 5 CVEs
 before 0.10.6-slfo.1.1_4.1
0.10.6-slfo.1.1_4.1
libssh
Ubuntu:Pro:16.04:LTS
 before 0.6.3-4.3ubuntu0.6+esm4, plus listed versions
0.6.3-3ubuntu30.6.3-4.10.6.3-4.20.6.3-4.2ubuntu10.6.3-4.3
Show 7 moreShow less
0.6.3-4.3ubuntu0.10.6.3-4.3ubuntu0.20.6.3-4.3ubuntu0.50.6.3-4.3ubuntu0.60.6.3-4.3ubuntu0.6+esm10.6.3-4.3ubuntu0.6+esm20.6.3-4.3ubuntu0.6+esm3
0.6.3-4.3ubuntu0.6+esm4
libssh
Ubuntu:Pro:18.04:LTS
 before 0.8.0~20170825.94fa1e38-1ubuntu0.7+esm6, plus listed versions
0.7.5-10.8.0~20170825.94fa1e38-10.8.0~20170825.94fa1e38-1build10.8.0~20170825.94fa1e38-1ubuntu0.10.8.0~20170825.94fa1e38-1ubuntu0.2
Show 6 moreShow less
0.8.0~20170825.94fa1e38-1ubuntu0.50.8.0~20170825.94fa1e38-1ubuntu0.60.8.0~20170825.94fa1e38-1ubuntu0.70.8.0~20170825.94fa1e38-1ubuntu0.7+esm30.8.0~20170825.94fa1e38-1ubuntu0.7+esm40.8.0~20170825.94fa1e38-1ubuntu0.7+esm5
0.8.0~20170825.94fa1e38-1ubuntu0.7+esm6
libssh
Ubuntu:Pro:20.04:LTS
 before 0.9.3-2ubuntu2.5+esm3, plus listed versions
0.9.0-1ubuntu10.9.0-1ubuntu40.9.0-1ubuntu50.9.3-2ubuntu10.9.3-2ubuntu2
Show 7 moreShow less
0.9.3-2ubuntu2.10.9.3-2ubuntu2.20.9.3-2ubuntu2.30.9.3-2ubuntu2.40.9.3-2ubuntu2.50.9.3-2ubuntu2.5+esm10.9.3-2ubuntu2.5+esm2
0.9.3-2ubuntu2.5+esm3
libssh
Ubuntu:22.04:LTS
 before 0.9.6-2ubuntu0.22.04.6, plus listed versions
0.9.6-10.9.6-1build10.9.6-20.9.6-2build10.9.6-2ubuntu0.22.04.1
Show 4 moreShow less
0.9.6-2ubuntu0.22.04.20.9.6-2ubuntu0.22.04.30.9.6-2ubuntu0.22.04.40.9.6-2ubuntu0.22.04.5
0.9.6-2ubuntu0.22.04.6
libssh
Ubuntu:24.04:LTS
 before 0.10.6-2ubuntu0.3, plus listed versions
0.10.5-3ubuntu10.10.5-3ubuntu20.10.6-20.10.6-2build10.10.6-2build20.10.6-2ubuntu0.10.10.6-2ubuntu0.2
0.10.6-2ubuntu0.3
libssh
Ubuntu:25.10
 before 0.11.2-1ubuntu0.2, plus listed versions
0.11.1-10.11.1-20.11.2-10.11.2-1build10.11.2-1ubuntu0.1
0.11.2-1ubuntu0.2
libssh
Ubuntu:22.04:LTS
From an advisory covering 6 CVEs
 before 0.9.6-2ubuntu0.22.04.6, plus listed versions
0.9.6-10.9.6-1build10.9.6-20.9.6-2build10.9.6-2ubuntu0.22.04.1
Show 4 moreShow less
0.9.6-2ubuntu0.22.04.20.9.6-2ubuntu0.22.04.30.9.6-2ubuntu0.22.04.40.9.6-2ubuntu0.22.04.5
0.9.6-2ubuntu0.22.04.6
libssh
Ubuntu:24.04:LTS
From an advisory covering 6 CVEs
 before 0.10.6-2ubuntu0.3, plus listed versions
0.10.5-3ubuntu10.10.5-3ubuntu20.10.6-20.10.6-2build10.10.6-2build20.10.6-2ubuntu0.10.10.6-2ubuntu0.2
0.10.6-2ubuntu0.3
libssh
Ubuntu:25.10
From an advisory covering 6 CVEs
 before 0.11.2-1ubuntu0.2, plus listed versions
0.11.1-10.11.1-20.11.2-10.11.2-1build10.11.2-1ubuntu0.1
0.11.2-1ubuntu0.2
libssh
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 0.11.4-1.1
0.11.4-1.1

History

History
RecordedChangedSources
affected
factsOSV
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-0968 is a low vulnerability (CVSS 3.1) in Libssh, published February 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 40th percentile. Fixed in libssh 0.11.4-r0.

References

Show 131 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open