F5-K000163675: Medium severity F5 F5OS vulnerability

Published Oct 12, 2026

Updated

A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service.

Affected Software

1 affected component

F5 F5OS=2.0.0

Event History

Oct 12, 2026

Advisory Published

via F5·10:57 PM

Data Sourced

via F5·10:57 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which systems are exposed to this issue?

F5 F5OS systems that use libssh as an SFTP client are exposed when they connect to a malicious SFTP server.

What does an attacker need to do to trigger the denial of service?

The attacker needs to operate or control an SFTP server that the affected libssh client connects to. The server can send responses using unknown request IDs, causing the client to retain queued responses indefinitely.

What is the expected impact of exploitation?

Exploitation causes unbounded memory growth in the libssh client and can result in a client-side denial of service. The provided data does not indicate confidentiality or integrity impact.

F5-K000163675: Medium severity F5 F5OS vulnerability

Affected Software

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What does an attacker need to do to trigger the denial of service?

What is the expected impact of exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What does an attacker need to do to trigger the denial of service?

What is the expected impact of exploitation?