CVE-2026-59848: Libssh: libssh: denial of service via sftp responses with unknown request ids
A flaw was found in libssh client-side SFTP message handling. In sftpgetmessage() in src/sftpcommon.c, SFTP responses carrying unknown request IDs were accepted and kept queued instead of being rejected. A malicious SFTP server can repeatedly send responses for request IDs that were never issued by the client, causing unbounded growth of queued messages and leading to client-side memory exhaustion and denial of service.
Other sources
A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service.
— MITRE
Libssh: libssh: denial of service via sftp responses with unknown request ids
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.10.6-9 - Upgrade
Upgrade
debian/libsshto a version that resolves this vulnerability.Fixed in 0.11.5-0+deb13u1Fixed in 0.12.2-1 - Configuration
In src/sftp_common.c, change sftp_get_message() so that SFTP responses carrying unknown request IDs are rejected and not kept queued indefinitely (avoid unbounded queued-message growth).
libssh (SFTP) Behavior in sftp_get_message() (src/sftp_common.c) for responses with unknown request IDs = Reject unknown request IDs instead of queuing them indefinitely
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59848?
CVE-2026-59848 has a medium severity rating of 5.3.
How does CVE-2026-59848 affect libssh?
CVE-2026-59848 affects libssh by allowing a denial of service through improper handling of SFTP messages with unknown request IDs.
What impact does CVE-2026-59848 have on SFTP communication?
The impact of CVE-2026-59848 is that a malicious SFTP server can cause a denial of service by sending incorrect responses that can overwhelm the client.
How do I mitigate the risks associated with CVE-2026-59848?
To mitigate CVE-2026-59848, upgrade to the latest version of libssh where the vulnerability has been patched.
Is authentication required to exploit CVE-2026-59848?
No, authentication is not required to exploit CVE-2026-59848, as it can be triggered by any SFTP server.