{"id":"CVE-2026-3731","aliases":["AZL-79544","AZL-79547","BELL-CVE-2026-3731","CLSA-2026-1773830791","CLSA-2026-1773929316","CLSA-2026-1773930007","CLSA-2026-1773930993","CLSA-2026-1773931583","CLSA-2026-1773932358","CLSA-2026-1774007374","CLSA-2026-1774007526","DEBIAN-CVE-2026-3731","EUVD-2026-10234","GHSA-wg5h-wgv3-pgqh","JLSEC-2026-784","OESA-2026-1560","OESA-2026-1652","OESA-2026-1653","OESA-2026-1654","OESA-2026-1655","OESA-2026-1656","RHSA-2026:7067","ROOT-OS-UBUNTU-2404-CVE-2026-3731","SUSE-SU-2026:0936-1","SUSE-SU-2026:1310-1","SUSE-SU-2026:1344-1","SUSE-SU-2026:1565-1","SUSE-SU-2026:20767-1","SUSE-SU-2026:23056-1","SUSE-SU-2026:3302-1","UBUNTU-CVE-2026-3731","USN-8093-1","USN-8093-2"],"status":"published","title":"libssh SFTP Extension Name sftp.c sftp_extensions_get_data out-of-bounds","description":"A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00724,"percentile":0.54323,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119","CWE-125"],"published":"2026-03-08T10:32:19Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"libssh","fixed_in":["0.10.6-6"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"libssh","fixed_in":["0.11.4-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"libssh","fixed_in":["0.11.4-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"libssh","fixed_in":["0.11.4-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libssh","fixed_in":["0.10.4-8.el9.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libssh-config","fixed_in":["0.10.4-8.el9.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libssh-devel","fixed_in":["0.10.4-8.el9.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libssh-4","fixed_in":["0.6.3-4.3ubuntu0.6+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libssh-dev","fixed_in":["0.6.3-4.3ubuntu0.6+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libssh-doc","fixed_in":["0.6.3-4.3ubuntu0.6+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libssh-gcrypt-4","fixed_in":["0.6.3-4.3ubuntu0.6+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libssh-gcrypt-dev","fixed_in":["0.6.3-4.3ubuntu0.6+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libssh-4","fixed_in":["0.8.0~20170825.94fa1e38-1ubuntu0.7+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libssh-dev","fixed_in":["0.8.0~20170825.94fa1e38-1ubuntu0.7+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libssh-doc","fixed_in":["0.8.0~20170825.94fa1e38-1ubuntu0.7+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libssh-gcrypt-4","fixed_in":["0.8.0~20170825.94fa1e38-1ubuntu0.7+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libssh-gcrypt-dev","fixed_in":["0.8.0~20170825.94fa1e38-1ubuntu0.7+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"libssh","fixed_in":["0.9.4-3.el8.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"libssh-config","fixed_in":["0.9.4-3.el8.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"libssh-devel","fixed_in":["0.9.4-3.el8.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"libssh","fixed_in":["0.9.4-3.el8.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"libssh-config","fixed_in":["0.9.4-3.el8.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"libssh-devel","fixed_in":["0.9.4-3.el8.tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libssh","fixed_in":["0.10.4-15.el9_6.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libssh-config","fixed_in":["0.10.4-15.el9_6.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libssh-devel","fixed_in":["0.10.4-15.el9_6.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"libssh","fixed_in":["0.9.6-14.el8.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"libssh-config","fixed_in":["0.9.6-14.el8.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"libssh-devel","fixed_in":["0.9.6-14.el8.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libssh-4","fixed_in":["0.9.3-2ubuntu2.5+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libssh-dev","fixed_in":["0.9.3-2ubuntu2.5+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libssh-doc","fixed_in":["0.9.3-2ubuntu2.5+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libssh-gcrypt-4","fixed_in":["0.9.3-2ubuntu2.5+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libssh-gcrypt-dev","fixed_in":["0.9.3-2ubuntu2.5+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libssh","fixed_in":["0.10.6-0+deb12u3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libssh","fixed_in":["0.11.5-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libssh","fixed_in":["0.12.0-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"libssh_jll","fixed_in":["0.11.4+0"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"libssh","fixed_in":["0.10.5-10.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"libssh","fixed_in":["0.9.4-16.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"libssh","fixed_in":["0.9.6-16.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"libssh","fixed_in":["0.10.5-10.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"libssh","fixed_in":["0.10.5-10.oe2403sp1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"libssh","fixed_in":["0.9.8-150200.13.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libssh","fixed_in":["0.9.8-150600.11.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"libssh","fixed_in":["0.9.8-150600.11.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"libssh","fixed_in":["0.10.6-slfo.1.1_5.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libssh","fixed_in":["0.6.3-4.3ubuntu0.6+esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libssh","fixed_in":["0.8.0~20170825.94fa1e38-1ubuntu0.7+esm7"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libssh","fixed_in":["0.9.3-2ubuntu2.5+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libssh","fixed_in":["0.9.6-2ubuntu0.22.04.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libssh","fixed_in":["0.10.6-2ubuntu0.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"libssh","fixed_in":["0.11.2-1ubuntu0.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libssh","fixed_in":["0.11.3-1ubuntu2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.10.6-5"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.6-6"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.10.4-r0"},{"fixed":"0.11.4-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.11.1-r0"},{"fixed":"0.11.4-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.6-r1"},{"fixed":"0.11.4-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.4-8.el9.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libssh-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.4-8.el9.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libssh-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.4-8.el9.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libssh-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-4.3ubuntu0.6+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libssh-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-4.3ubuntu0.6+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libssh-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-4.3ubuntu0.6+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libssh-gcrypt-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-4.3ubuntu0.6+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libssh-gcrypt-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-4.3ubuntu0.6+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libssh-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0~20170825.94fa1e38-1ubuntu0.7+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libssh-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0~20170825.94fa1e38-1ubuntu0.7+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libssh-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0~20170825.94fa1e38-1ubuntu0.7+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libssh-gcrypt-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0~20170825.94fa1e38-1ubuntu0.7+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libssh-gcrypt-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0~20170825.94fa1e38-1ubuntu0.7+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.4-3.el8.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libssh-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.4-3.el8.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libssh-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.4-3.el8.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.4-3.el8.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"libssh-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.4-3.el8.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"libssh-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.4-3.el8.tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.4-15.el9_6.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libssh-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.4-15.el9_6.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libssh-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.4-15.el9_6.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-14.el8.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"libssh-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-14.el8.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"libssh-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-14.el8.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libssh-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.3-2ubuntu2.5+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libssh-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.3-2ubuntu2.5+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libssh-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.3-2ubuntu2.5+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libssh-gcrypt-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.3-2ubuntu2.5+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libssh-gcrypt-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.3-2ubuntu2.5+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.6-0+deb12u3"}]}],"versions":["0.10.5-2","0.10.5-3","0.10.5-3+hurd.1","0.10.6-0+deb12u1","0.10.6-0+deb12u2"]},{"source":"osv","ecosystem":"Debian:13","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.5-0+deb13u1"}]}],"versions":["0.11.2-1","0.11.2-1+deb13u1","0.11.3-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.0-1"}]}],"versions":["0.11.2-1","0.11.3-1"]},{"source":"osv","ecosystem":"Julia","package":"libssh_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.11.4+0"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.5-10.oe2403sp3"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.5-10.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.4-16.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-16.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.5-10.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.5-10.oe2403sp1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.0-1.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libssh-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.0-1.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libssh-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.0-1.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150200.13.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150600.11.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150600.11.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-12.28.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.17.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.17.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-150400.3.17.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.6-slfo.1.1_5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.6-5.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-3.24.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8-3.24.1"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-4.3ubuntu0.6+esm5"}]}],"versions":["0.6.3-3ubuntu3","0.6.3-4.1","0.6.3-4.2","0.6.3-4.2ubuntu1","0.6.3-4.3","0.6.3-4.3ubuntu0.1","0.6.3-4.3ubuntu0.2","0.6.3-4.3ubuntu0.5","0.6.3-4.3ubuntu0.6","0.6.3-4.3ubuntu0.6+esm1","0.6.3-4.3ubuntu0.6+esm2","0.6.3-4.3ubuntu0.6+esm3","0.6.3-4.3ubuntu0.6+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0~20170825.94fa1e38-1ubuntu0.7+esm7"}]}],"versions":["0.7.5-1","0.8.0~20170825.94fa1e38-1","0.8.0~20170825.94fa1e38-1build1","0.8.0~20170825.94fa1e38-1ubuntu0.1","0.8.0~20170825.94fa1e38-1ubuntu0.2","0.8.0~20170825.94fa1e38-1ubuntu0.5","0.8.0~20170825.94fa1e38-1ubuntu0.6","0.8.0~20170825.94fa1e38-1ubuntu0.7","0.8.0~20170825.94fa1e38-1ubuntu0.7+esm3","0.8.0~20170825.94fa1e38-1ubuntu0.7+esm4","0.8.0~20170825.94fa1e38-1ubuntu0.7+esm5","0.8.0~20170825.94fa1e38-1ubuntu0.7+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.3-2ubuntu2.5+esm4"}]}],"versions":["0.9.0-1ubuntu1","0.9.0-1ubuntu4","0.9.0-1ubuntu5","0.9.3-2ubuntu1","0.9.3-2ubuntu2","0.9.3-2ubuntu2.1","0.9.3-2ubuntu2.2","0.9.3-2ubuntu2.3","0.9.3-2ubuntu2.4","0.9.3-2ubuntu2.5","0.9.3-2ubuntu2.5+esm1","0.9.3-2ubuntu2.5+esm2","0.9.3-2ubuntu2.5+esm3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-2ubuntu0.22.04.7"}]}],"versions":["0.9.6-1","0.9.6-1build1","0.9.6-2","0.9.6-2build1","0.9.6-2ubuntu0.22.04.1","0.9.6-2ubuntu0.22.04.2","0.9.6-2ubuntu0.22.04.3","0.9.6-2ubuntu0.22.04.4","0.9.6-2ubuntu0.22.04.5","0.9.6-2ubuntu0.22.04.6"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.6-2ubuntu0.4"}]}],"versions":["0.10.5-3ubuntu1","0.10.5-3ubuntu2","0.10.6-2","0.10.6-2build1","0.10.6-2build2","0.10.6-2ubuntu0.1","0.10.6-2ubuntu0.2","0.10.6-2ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.2-1ubuntu0.3"}]}],"versions":["0.11.1-1","0.11.1-2","0.11.2-1","0.11.2-1build1","0.11.2-1ubuntu0.1","0.11.2-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.3-1ubuntu2"}]}],"versions":["0.11.2-1build1","0.11.3-1","0.11.3-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-4.3ubuntu0.6+esm5"}]}],"versions":["0.6.3-3ubuntu3","0.6.3-4.1","0.6.3-4.2","0.6.3-4.2ubuntu1","0.6.3-4.3","0.6.3-4.3ubuntu0.1","0.6.3-4.3ubuntu0.2","0.6.3-4.3ubuntu0.5","0.6.3-4.3ubuntu0.6","0.6.3-4.3ubuntu0.6+esm1","0.6.3-4.3ubuntu0.6+esm2","0.6.3-4.3ubuntu0.6+esm3","0.6.3-4.3ubuntu0.6+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0~20170825.94fa1e38-1ubuntu0.7+esm7"}]}],"versions":["0.7.5-1","0.8.0~20170825.94fa1e38-1","0.8.0~20170825.94fa1e38-1build1","0.8.0~20170825.94fa1e38-1ubuntu0.1","0.8.0~20170825.94fa1e38-1ubuntu0.2","0.8.0~20170825.94fa1e38-1ubuntu0.5","0.8.0~20170825.94fa1e38-1ubuntu0.6","0.8.0~20170825.94fa1e38-1ubuntu0.7","0.8.0~20170825.94fa1e38-1ubuntu0.7+esm3","0.8.0~20170825.94fa1e38-1ubuntu0.7+esm4","0.8.0~20170825.94fa1e38-1ubuntu0.7+esm5","0.8.0~20170825.94fa1e38-1ubuntu0.7+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.3-2ubuntu2.5+esm4"}]}],"versions":["0.9.0-1ubuntu1","0.9.0-1ubuntu4","0.9.0-1ubuntu5","0.9.3-2ubuntu1","0.9.3-2ubuntu2","0.9.3-2ubuntu2.1","0.9.3-2ubuntu2.2","0.9.3-2ubuntu2.3","0.9.3-2ubuntu2.4","0.9.3-2ubuntu2.5","0.9.3-2ubuntu2.5+esm1","0.9.3-2ubuntu2.5+esm2","0.9.3-2ubuntu2.5+esm3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-2ubuntu0.22.04.7"}]}],"versions":["0.9.6-1","0.9.6-1build1","0.9.6-2","0.9.6-2build1","0.9.6-2ubuntu0.22.04.1","0.9.6-2ubuntu0.22.04.2","0.9.6-2ubuntu0.22.04.3","0.9.6-2ubuntu0.22.04.4","0.9.6-2ubuntu0.22.04.5","0.9.6-2ubuntu0.22.04.6"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.6-2ubuntu0.4"}]}],"versions":["0.10.5-3ubuntu1","0.10.5-3ubuntu2","0.10.6-2","0.10.6-2build1","0.10.6-2build2","0.10.6-2ubuntu0.1","0.10.6-2ubuntu0.2","0.10.6-2ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.2-1ubuntu0.3"}]}],"versions":["0.11.1-1","0.11.1-2","0.11.2-1","0.11.2-1build1","0.11.2-1ubuntu0.1","0.11.2-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.3-1ubuntu2"}]}],"versions":["0.11.2-1build1","0.11.3-1","0.11.3-1ubuntu1"]}],"products":[{"vendor":"libssh","product":"libssh"}],"references":[{"url":"https://vuldb.com/?id.349709","tags":["vdb-entry","technical-description","Third Party Advisory","VDB Entry","advisory","web","article"]},{"url":"https://vuldb.com/?ctiid.349709","tags":["signature","permissions-required","Permissions Required","VDB Entry","report","web","article"]},{"url":"https://vuldb.com/?submit.767120","tags":["third-party-advisory","Third Party Advisory","VDB Entry","advisory","web","article"]},{"url":"https://www.libssh.org/security/advisories/libssh-2026-sftp-extensions.txt","tags":["related","Product","advisory","web","article"]},{"url":"https://gitlab.com/libssh/libssh-mirror/-/commit/855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60","tags":["patch","Patch","fix","web","article"]},{"url":"https://www.libssh.org/files/0.12/libssh-0.12.0.tar.xz","tags":["patch","Patch","Third Party Advisory","fix","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3731","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-wg5h-wgv3-pgqh"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-3731","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1773830791.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1773929316.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1773930007.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1773930993.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2026-1773931583.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1773932358.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1774007374.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1774007526.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3731.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-3731","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1560","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0964","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0965","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0966","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0967","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0968","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1652","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1653","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1654","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1655","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1656","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7067","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-3731","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-0966","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-14821","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7067.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2423148","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-14821","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14821","tags":["advisory"]},{"url":"https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2433121","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-0966","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445579","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-3731","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260936-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1259377","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3731","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261310-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261344-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1258045","tags":["report"]},{"url":"https://bugzilla.suse.com/1258049","tags":["report"]},{"url":"https://bugzilla.suse.com/1258054","tags":["report"]},{"url":"https://bugzilla.suse.com/1258080","tags":["report"]},{"url":"https://bugzilla.suse.com/1258081","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-0964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-0965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-0966","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-0967","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-0968","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261565-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620767-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623056-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1272164","tags":["report"]},{"url":"https://bugzilla.suse.com/1272165","tags":["report"]},{"url":"https://bugzilla.suse.com/1272166","tags":["report"]},{"url":"https://bugzilla.suse.com/1272167","tags":["report"]},{"url":"https://bugzilla.suse.com/1272168","tags":["report"]},{"url":"https://bugzilla.suse.com/1272169","tags":["report"]},{"url":"https://bugzilla.suse.com/1272171","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59843","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59844","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59850","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263302-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-3731","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8093-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8093-2","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-3731","title":"libssh SFTP Extension Name sftp.c sftp_extensions_get_data out-of-bounds","description":"A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component.","status":"published","published":"2026-03-08T10:32:19.482Z","modified":"2026-03-11T19:50:33.441Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X","level":"medium","assessor":"cna"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C","level":"medium","assessor":"cna"},{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C","level":"medium","assessor":"cna"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P/E:ND/RL:OF/RC:C","assessor":"cna"}],"cwes":["CWE-125","CWE-119"],"updated_at":"2026-11-02T13:49:09.229322Z"}],"euvd":[{"id":"EUVD-2026-10234","description":"A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component.","status":"published","published":"2026-03-08T10:32:19Z","modified":"2026-03-11T19:50:33Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X","level":"medium"}],"updated_at":"2026-11-02T19:25:36.762699Z"}],"ghsa":[{"id":"GHSA-wg5h-wgv3-pgqh","title":"A weakness has been identified in libssh up to 0.11.3. The impacted element is the function...","description":"A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component.","status":"published","published":"2026-03-08T12:30:26Z","modified":"2026-03-08T12:30:34Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T15:06:30.378091Z"}],"nvd":[{"id":"CVE-2026-3731","description":"A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component.","status":"published","published":"2026-03-08T11:15:50.307Z","modified":"2026-06-17T10:44:05.853Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"secondary"}],"cwes":["CWE-119","CWE-125"],"updated_at":"2026-11-02T14:12:08.279852Z"}],"osv":[{"id":"BELL-CVE-2026-3731","status":"published","published":"2026-03-11T06:09:14.356419Z","modified":"2026-03-18T07:22:35.566475Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:23.572955Z"},{"id":"CVE-2026-3731","title":"libssh SFTP Extension Name sftp.c sftp_extensions_get_data out-of-bounds","description":"A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component.","status":"published","published":"2026-03-08T10:32:19.482Z","modified":"2026-10-28T11:12:15.097309417Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X","level":"medium"}],"cwes":["CWE-119","CWE-125"],"updated_at":"2026-11-02T15:45:03.040464Z"},{"id":"DEBIAN-CVE-2026-3731","description":"A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component.","status":"published","published":"2026-03-08T11:15:50.307Z","modified":"2026-10-20T21:00:06.125972571Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"JLSEC-2026-784","description":"A weakness has been identified in libssh up to 0.11.3. The impacted element is the function `sftp_extensions_get_name/sftp_extensions_get_data` of the file `src/sftp.c` of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component.","status":"published","published":"2026-07-23T14:46:44.71Z","modified":"2026-07-25T18:24:02.298006351Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:47:19.003546Z"},{"id":"OESA-2026-1560","title":"libssh security update","description":"The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote programs. With its Secure FTP implementation, you can play with remote files easily, without third-party programs others than libcrypto (from openssl).\r\n\r\nSecurity Fix(es):\n\n(CVE-2026-0964)\n\n(CVE-2026-0965)\n\n(CVE-2026-0966)\n\n(CVE-2026-0967)\n\n(CVE-2026-0968)\n\nA weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component.(CVE-2026-3731)","status":"published","published":"2026-03-15T11:10:34Z","modified":"2026-08-18T01:19:36.969341781Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1652","title":"libssh security update","description":"The ssh library was designed to be used by programmers needing a working SSH\nimplementation by the mean of a library. The complete control of the client is\nmade by the programmer. With libssh, you can remotely execute programs, transfer\nfiles, use a secure and transparent tunnel for your remote programs. With its\nSecure FTP implementation, you can play with remote files easily, without\nthird-party programs others than libcrypto (from openssl).\r\n\r\n\nSecurity Fix(es):\n\nA weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component.(CVE-2026-3731)","status":"published","published":"2026-03-20T11:10:41Z","modified":"2026-08-18T01:19:40.327214176Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1653","title":"libssh security update","description":"The ssh library was designed to be used by programmers needing a working SSH\nimplementation by the mean of a library. The complete control of the client is\nmade by the programmer. With libssh, you can remotely execute programs, transfer\nfiles, use a secure and transparent tunnel for your remote programs. With its\nSecure FTP implementation, you can play with remote files easily, without\nthird-party programs others than libcrypto (from openssl).\r\n\r\n\nSecurity Fix(es):\n\nA weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component.(CVE-2026-3731)","status":"published","published":"2026-03-20T11:10:41Z","modified":"2026-08-18T01:19:40.477038588Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1654","title":"libssh security update","description":"The ssh library was designed to be used by programmers needing a working SSH\nimplementation by the mean of a library. The complete control of the client is\nmade by the programmer. With libssh, you can remotely execute programs, transfer\nfiles, use a secure and transparent tunnel for your remote programs. With its\nSecure FTP implementation, you can play with remote files easily, without\nthird-party programs others than libcrypto (from openssl).\r\n\r\n\nSecurity Fix(es):\n\nA weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component.(CVE-2026-3731)","status":"published","published":"2026-03-20T11:10:41Z","modified":"2026-08-18T01:19:40.460156559Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1655","title":"libssh security update","description":"The ssh library was designed to be used by programmers needing a working SSH\nimplementation by the mean of a library. The complete control of the client is\nmade by the programmer. With libssh, you can remotely execute programs, transfer\nfiles, use a secure and transparent tunnel for your remote programs. With its\nSecure FTP implementation, you can play with remote files easily, without\nthird-party programs others than libcrypto (from openssl).\r\n\r\n\nSecurity Fix(es):\n\nA weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component.(CVE-2026-3731)","status":"published","published":"2026-03-20T11:10:41Z","modified":"2026-08-18T01:19:40.473732835Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1656","title":"libssh security update","description":"The ssh library was designed to be used by programmers needing a working SSH\nimplementation by the mean of a library. The complete control of the client is\nmade by the programmer. With libssh, you can remotely execute programs, transfer\nfiles, use a secure and transparent tunnel for your remote programs. With its\nSecure FTP implementation, you can play with remote files easily, without\nthird-party programs others than libcrypto (from openssl).\r\n\r\n\nSecurity Fix(es):\n\nA weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component.(CVE-2026-3731)","status":"published","published":"2026-03-20T11:10:41Z","modified":"2026-08-18T01:19:40.419874421Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"RHSA-2026:7067","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-21T10:09:46Z","modified":"2026-10-06T10:31:09.520546515Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"ROOT-OS-UBUNTU-2404-CVE-2026-3731","title":"CVE-2026-3731 in rootio-libssh - Patched by Root","description":"Root has patched CVE-2026-3731 in the rootio-libssh package for Root:Ubuntu:24.04. Multiple fixed versions available.","status":"withdrawn","published":"2026-03-16T14:22:48Z","modified":"2026-08-20T14:00:14.274129692Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:38.949188Z"},{"id":"UBUNTU-CVE-2026-3731","description":"A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component.","status":"published","published":"2026-03-08T11:15:00Z","modified":"2026-10-27T04:17:55.281393002Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:56:16.686388Z"},{"id":"AZL-79544","title":"CVE-2026-3731 affecting package libssh 0.10.6-5","description":"A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component.","status":"published","published":"2026-03-08T11:15:50Z","modified":"2026-04-21T04:34:46.244922Z","updated_at":"2026-11-02T15:28:10.017343Z"},{"id":"AZL-79547","title":"CVE-2026-3731 affecting package libssh for versions less than 0.10.6-6","description":"A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component.","status":"published","published":"2026-03-08T11:15:50Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.800038Z"},{"id":"CLSA-2026-1773830791","title":"libssh: Fix of CVE-2026-3731","description":"- CVE-2026-3731: fix out-of-bounds read in sftp_extensions_get_name and\n  sftp_extensions_get_data when idx equals the extension count","status":"published","published":"2026-03-18T10:46:36Z","modified":"2026-06-01T00:32:08.708659398Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1773929316","title":"Fix CVE(s): CVE-2026-3731","description":"   * SECURITY UPDATE: remote out-of-bounds read in SFTP extension name handler\n     - debian/patches/CVE-2026-3731.patch: Fix out-of-bound read from sftp\n       extensions; correct index comparison from '\u003e' to '\u003e=' and prevent access\n       past extension count.\n     - CVE-2026-3731","status":"published","published":"2026-03-19T14:08:41Z","modified":"2026-06-04T10:03:51.307737Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1773930007","title":"Fix CVE(s): CVE-2026-3731","description":"   * SECURITY UPDATE: out-of-bounds read from manipulated SFTP extension index\n     - debian/patches/CVE-2026-3731.patch: Fix out-of-bound read in sftp\n       extensions by replacing '\u003e' with '\u003e=' in index checks; cause: off-by-one\n       error in index comparison allowing idx equal count.\n     - CVE-2026-3731","status":"published","published":"2026-03-19T18:19:44Z","modified":"2026-06-04T10:04:01.07883Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1773930993","title":"libssh: Fix of CVE-2026-3731","description":"- CVE-2026-3731: fix off-by-one in sftp_extensions_get_name/sftp_extensions_get_data","status":"published","published":"2026-03-19T14:36:37Z","modified":"2026-06-01T00:33:21.492042102Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1773931583","title":"libssh: Fix of CVE-2026-3731","description":"- CVE-2026-3731: fix off-by-one in sftp_extensions_get_name/sftp_extensions_get_data","status":"published","published":"2026-03-19T14:46:28Z","modified":"2026-06-01T00:33:23.326938304Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1773932358","title":"libssh: Fix of CVE-2026-3731","description":"- Fix CVE-2026-3731: out-of-bounds read in SFTP extension name handler","status":"published","published":"2026-03-19T14:59:23Z","modified":"2026-06-01T00:32:43.594730542Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774007374","title":"libssh: Fix of CVE-2026-3731","description":"- CVE-2026-3731: Validate idx and add bounds checks; prevent out-of-bounds read\n  in SFTP Extension Name Handler via manipulated idx.","status":"published","published":"2026-03-20T11:49:39Z","modified":"2026-06-01T00:33:14.782292195Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774007526","title":"Fix CVE(s): CVE-2026-3731","description":"   * SECURITY UPDATE: out-of-bounds read in sftp extension name handler\n     - debian/patches/CVE-2026-3731.patch: fix off-by-one bounds check\n       in sftp_extensions_get_name and sftp_extensions_get_data\n     - CVE-2026-3731","status":"published","published":"2026-03-20T11:52:11Z","modified":"2026-06-04T10:04:07.327941Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"SUSE-SU-2026:0936-1","title":"Security update for libssh","description":"This update for libssh fixes the following issues:\n\n- CVE-2026-3731: Denial of Service via out-of-bounds read in SFTP extension name handler (bsc#1259377).\n","status":"published","published":"2026-03-20T07:46:48Z","modified":"2026-03-21T08:15:06.056194Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:1310-1","title":"Security update for libssh","description":"This update for libssh fixes the following issues:\n\n- CVE-2026-3731: Denial of Service via out-of-bounds read in SFTP extension name handler (bsc#1259377).\n","status":"published","published":"2026-04-14T10:42:14Z","modified":"2026-04-15T08:00:07.091544Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:1344-1","title":"Security update for libssh","description":"This update for libssh fixes the following issues:\n\n- CVE-2026-3731: denial of service via out-of-bounds read in SFTP extension name handler (bsc#1259377).\n- CVE-2026-0964: SCP protocol path traversal in `ssh_scp_pull_request()` (bsc#1258049).\n- CVE-2026-0965: possible denial of service when parsing unexpected configuration files (bsc#1258045).\n- CVE-2026-0966: buffer underflow in `ssh_get_hexa()` on invalid input (bsc#1258054).\n- CVE-2026-0967: specially crafted patterns could cause a denial of service (bsc#1258081).\n- CVE-2026-0968: out-of-bounds read in `sftp_parse_longname()` (bsc#1258080).\n","status":"published","published":"2026-04-15T10:21:31Z","modified":"2026-04-16T08:31:12.754477Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:1565-1","title":"Security update for libssh","description":"This update for libssh fixes the following issues:\n\n- CVE-2026-0964: improper sanitation of paths received from SCP servers can cause path traversal (bsc#1258049).\n- CVE-2026-0965: possible denial of service when parsing unexpected configuration files (bsc#1258045).\n- CVE-2026-0966: buffer underflow in ssh_get_hexa() on invalid input (bsc#1258054).\n- CVE-2026-0967: specially crafted patterns could cause denial of service (bsc#1258081).\n- CVE-2026-0968: malformed SFTP message can lead to out of bound read (bsc#1258080).\n- CVE-2026-3731: denial of service via out-of-bounds read in SFTP extension name handler (bsc#1259377).\n","status":"published","published":"2026-04-23T07:08:38Z","modified":"2026-04-24T08:15:29.87476Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:20767-1","title":"Security update for libssh","description":"This update for libssh fixes the following issue:\n\n- CVE-2026-3731: Denial of Service via out-of-bounds read in SFTP extension name handler (bsc#1259377).\n","status":"published","published":"2026-03-19T11:23:34Z","modified":"2026-03-25T17:33:48.554314Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:23056-1","title":"Security update for libssh","description":"This update for libssh fixes the following issues:\n\n- CVE-2026-3731: denial of Service via out-of-bounds read in SFTP extension name handler (bsc#1259377).\n- CVE-2026-59843: denial of service via zero advertised channel packet size (bsc#1272164).\n- CVE-2026-59844: denial of service via oversized SFTP read length (bsc#1272165).\n- CVE-2026-59845: denial of service via unchecked ProxyCommand fork() failure (bsc#1272166).\n- CVE-2026-59846: information disclosure via ProxyCommand %r username expansion (bsc#1272167).\n- CVE-2026-59847: integrity downgrade via OpenSSL AES-GCM tag verification (bsc#1272168).\n- CVE-2026-59848: denial of service via SFTP responses with unknown request IDs (bsc#1272169).\n- CVE-2026-59850: use-after-free via data callbacks on closed channels (bsc#1272171).\n","status":"published","published":"2026-08-06T11:02:18Z","modified":"2026-08-12T18:23:40.37930639Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:3302-1","title":"Security update for libssh","description":"This update for libssh fixes the following issues\n\n- CVE-2026-3731: denial of service via out-of-bounds read in SFTP extension name handler (bsc#1259377).\n- CVE-2026-59843: denial of service via zero advertised channel packet size (bsc#1272164).\n- CVE-2026-59844: denial of service via oversized SFTP read length (bsc#1272165).\n- CVE-2026-59845: denial of service via unchecked ProxyCommand fork() failure (bsc#1272166).\n- CVE-2026-59846: information disclosure via ProxyCommand %r username expansion (bsc#1272167).\n- CVE-2026-59847: integrity downgrade via OpenSSL AES-GCM tag verification (bsc#1272168).\n- CVE-2026-59848: denial of service via SFTP responses with unknown request IDs (bsc#1272169).\n- CVE-2026-59850: use-after-free via data callbacks on closed channels (bsc#1272171).\n","status":"published","published":"2026-07-27T17:09:28Z","modified":"2026-07-28T10:00:09.184487488Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"USN-8093-1","title":"libssh vulnerability","description":"It was discovered that libssh incorrectly performed bounds checking when\nprocessing SFTP extensions. If a client application queried extension data out\nof bounds, it could cause the application to crash, resulting in a denial of\nservice, or exhibit unintended behavior.","status":"published","published":"2026-03-16T10:57:11Z","modified":"2026-10-27T04:16:47.425885508Z","updated_at":"2026-11-02T16:58:22.951676Z"},{"id":"USN-8093-2","title":"libssh vulnerability","description":"USN-8093-1 fixed a vulnerability in libssh. This update provides\nthe corresponsing fix for Ubuntu 26.04 LTS.\n\nOriginal advisory details:\n\n It was discovered that libssh incorrectly performed bounds checking when\n processing SFTP extensions. If a client application queried extension data out\n of bounds, it could cause the application to crash, resulting in a denial of\n service, or exhibit unintended behavior.","status":"published","published":"2026-08-19T08:15:33Z","modified":"2026-10-27T04:16:53.805251432Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}