CVE-2026-0968

A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an SSH_FXP_NAME message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can cause unexpected behavior or lead to a denial of service (DoS) due to application crashes.

The vulnerability in libssh has been rated as Low by Red Hat Product Security.

This issue affects the libssh client when processing responses from an SFTP server. Successful exploitation requires a user to initiate a connection to a malicious or compromised SFTP server and perform specific operations, such as listing directory contents. As a result, exploitation is not possible without user interaction.

Additionally, the vulnerability depends on specially crafted protocol responses from a malicious server, increasing the attack complexity and reducing the likelihood of successful exploitation in typical deployments.

The impact of this flaw is limited to a client-side denial-of-service condition, such as an application crash. There is no evidence that this issue can be leveraged to execute arbitrary code, access sensitive information, or modify data.

Due to the requirement for user interaction, higher attack complexity, and limited impact on availability only, Red Hat considers this vulnerability to have a lower risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

A workaround suggested by upstream is to properly verify the identity of SFTP servers before connecting to them, as exploitation requires a libssh client to initiate a connection to a malicious or compromised SFTP server. Restricting SFTP connections to trusted and verified servers reduces the risk of exposure. The upstream project has issued fixed releases (libssh 0.11.4 and 0.12.0); updating to a version that includes the fix resolves the issue.