REDHAT-BUG-2498183: Use After Free
A flaw was found in libssh channel data handling. In channelrcvdata() in src/channels.c, incoming channel DATA messages could still be processed after the channel had already been marked as remotely closed. In SFTP-backed applications and other callback-driven consumers, this creates a path where data callbacks may observe channel-associated state after it has already been torn down or freed, leading to crashes and possible use-after-free conditions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2498183?
The severity of REDHAT-BUG-2498183 is medium with a score of 4.
How do I fix REDHAT-BUG-2498183?
To fix REDHAT-BUG-2498183, update the libssh library to the latest patched version that addresses the flaw.
What is the specific flaw in REDHAT-BUG-2498183?
REDHAT-BUG-2498183 involves a flaw in handling channel data within libssh that can lead to processing issues after a channel is marked as remotely closed.
What are the risks associated with REDHAT-BUG-2498183?
The risks associated with REDHAT-BUG-2498183 include potential data leaks and unpredictable behavior in SFTP-backed applications and other callback-driven consumers.
When was REDHAT-BUG-2498183 published?
REDHAT-BUG-2498183 was published on July 8, 2026.