CVE-2026-59844
Received Received - Intake

Memory Exhaustion in libssh SFTP Server

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: Red Hat, Inc.

Description
A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-21
AI Q&A
2026-07-21
EPSS Evaluated
N/A
NVD
CVE-2026-59844
EUVD
EUVD-2026-46179

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
libssh libssh *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-789 The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-59844 is a flaw in libssh where a remote authenticated client can send SFTP read requests with an extremely large length value. The server allocates memory based on this length without proper limits, leading to excessive memory consumption. Repeated requests can exhaust system memory, causing a denial of service.

Detection Guidance

Monitor for excessive memory usage on the libssh SFTP server during SFTP operations. Check for repeated large SFTP read requests in server logs. Use tools like netstat or ss to inspect active SFTP connections for unusual patterns.

Impact Analysis

If you run a libssh-based SFTP server, an attacker with valid credentials could crash your server by sending specially crafted read requests. This disrupts service availability for legitimate users and may require server restarts or resource-intensive recovery.

Compliance Impact

This vulnerability could indirectly impact compliance with standards like GDPR or HIPAA by enabling denial-of-service attacks that disrupt system availability. If exploited, it may lead to service unavailability, which could violate availability requirements in these regulations.

Mitigation Strategies

Apply the latest patches or updates for libssh to fix the memory allocation issue. Limit SFTP read request sizes in server configurations. Restrict authenticated client access to SFTP services until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59844. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart