CVE-2026-0968: Libssh: libssh: denial of service due to malformed sftp message
A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an SSHFXPNAME message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can cause unexpected behavior or lead to a denial of service (DoS) due to application crashes.
Other sources
A malicious SFTP server can send malformed longname field of the SSHFXPNAME message (file listing). Due to the missing NULL check, the libssh could read beyond the buffer bounds on heap, causing unexpected behavior or crashes.
— Red Hat
Libssh: libssh: denial of service due to malformed sftp message
— Microsoft
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0968?
CVE-2026-0968 is classified as a denial of service vulnerability.
How does CVE-2026-0968 affect libssh?
CVE-2026-0968 allows a malicious SFTP server to exploit libssh by sending a malformed 'longname' field causing a denial of service.
What versions of libssh are affected by CVE-2026-0968?
CVE-2026-0968 affects some versions of libssh, specifically those utilizing vulnerable SFTP functionalities.
How can I fix CVE-2026-0968?
To fix CVE-2026-0968, update to the latest version of libssh that addresses this vulnerability.
Is there a workaround for CVE-2026-0968?
Currently, there are no known effective workarounds for mitigating CVE-2026-0968, so updating is recommended.