https://www.libssh.org/2026/07/21/libssh-0-12-1-and-0-11-5-security-releases/ announces: Within the storm of AI-assisted reports, we are pleased to announce another libssh releases, bringing mostly security relevant fixes for both new features and code that was used for years.

A big thank you to all the security researchers who responsibly reported the issues to us, as well as to all the contributors who made this release possible!

For those new to libssh, we recommend checking out our getting started tutorial. If you have any questions, feel free to join our mailing list or visit our Matrix channel.

You can download libssh-0.12.1 here: https://www.libssh.org/files/0.12/ and libssh-0.11.5 in here: https://www.libssh.org/files/0.11/

ChangeLog for libssh 0.12.1:

Security:

CVE-2026-15370: Stack buffer overflow in SFTP server longname construction http://www.libssh.org/security/advisories/CVE-2026-15370.txt CVE-2026-59842: Information disclosure via short GSSAPI Curve25519 public key http://www.libssh.org/security/advisories/CVE-2026-59842.txt CVE-2026-59843: Denial of service via zero advertised channel packet size http://www.libssh.org/security/advisories/CVE-2026-59843.txt CVE-2026-59844: Denial of service via oversized SFTP read length http://www.libssh.org/security/advisories/CVE-2026-59844.txt CVE-2026-59845: Denial of service via unchecked ProxyCommand fork() failure http://www.libssh.org/security/advisories/CVE-2026-59845.txt CVE-2026-59846: Information disclosure via ProxyCommand %r username expansion http://www.libssh.org/security/advisories/CVE-2026-59846.txt CVE-2026-59847: Integrity downgrade via OpenSSL AES-GCM tag verification http://www.libssh.org/security/advisories/CVE-2026-59847.txt CVE-2026-59848: Denial of service via SFTP responses with unknown request IDs http://www.libssh.org/security/advisories/CVE-2026-59848.txt CVE-2026-59849: Denial of service via automatic certificate authentication loop http://www.libssh.org/security/advisories/CVE-2026-59849.txt CVE-2026-59850: Use-after-free via data callbacks on closed channels http://www.libssh.org/security/advisories/CVE-2026-59850.txt CVE-2026-59851: Authentication bypass via missing GSSAPI principal check http://www.libssh.org/security/advisories/CVE-2026-59851.txt Zero-initialize every sshstring

Compatibility:

Fix compatibility with C23 / gcc16 Allow hybrid ML-KEM key exchange in FIPS mode

Bugfixes:

Fix multiple memory leaks, null checks, and error checks Fix parameter size mismatch in mlkem768x25519-sha256 Fix client SFTP messages being ignored if sent at high rate Validate peer public key in DH key exchange Fix ambiguous error reporting of sftpinit Fix hidden integer underflow in socket packet callback Avoid remote window overflow Fix socket data callback return value on rekey failure Avoid off-by-one overflow during kbdint authentication Avoid logging uninitialized sequence numbers Avoid double conversion of SFTP version number Send correct SFTP server version number Avoid handling repeated SFTP INIT messages Harmonize return values from SFTP server callbacks

ChangeLog for libssh 0.11.5:

Security:

CVE-2026-15370: Stack buffer overflow in SFTP server longname construction http://www.libssh.org/security/advisories/CVE-2026-15370.txt CVE-2026-59843: Denial of service via zero advertised channel packet size http://www.libssh.org/security/advisories/CVE-2026-59843.txt CVE-2026-59844: Denial of service via oversized SFTP read length http://www.libssh.org/security/advisories/CVE-2026-59844.txt CVE-2026-59845: Denial of service via unchecked ProxyCommand fork() failure http://www.libssh.org/security/advisories/CVE-2026-59845.txt CVE-2026-59846: Information disclosure via ProxyCommand %r username expansion http://www.libssh.org/security/advisories/CVE-2026-59846.txt CVE-2026-59847: Integrity downgrade via OpenSSL AES-GCM tag verification http://www.libssh.org/security/advisories/CVE-2026-59847.txt CVE-2026-59848: Denial of service via SFTP responses with unknown request IDs http://www.libssh.org/security/advisories/CVE-2026-59848.txt CVE-2026-59849: Denial of service via automatic certificate authentication loop http://www.libssh.org/security/advisories/CVE-2026-59849.txt CVE-2026-59850: Use-after-free via data callbacks on closed channels http://www.libssh.org/security/advisories/CVE-2026-59850.txt Zero-initialize every sshstring

Compatibility:

Fix compatibility with C23 / gcc16

Bugfixes:

Fix multiple memory leaks, null checks, and error checks Validate peer public key in DH key exchange Avoid remote window overflow Avoid off-by-one overflow during kbdint authentication Avoid logging uninitialized sequence numbers Avoid double conversion of SFTP version number Send correct SFTP server version number Avoid handling repeated SFTP INIT messages Harmonize return values from SFTP server callbacks

A flaw was found in libssh server-side SFTP directory listing. In processreaddir() in src/sftpserver.c, the server allocates a fixed stack buffer as char longname[MAXLONGNAMELEN] and passes attacker-controlled directory entry names into readdirlongname(). In the pre-patch implementation, readdirlongname() appends metadata and the filename into zlongname with repeated unbounded strcat() calls. Because zlongname points at the caller-owned fixed stack buffer, sufficiently long filenames in an attacker-controlled directory can overflow that stack buffer during SSHFXPREADDIR processing, leading to crashes and possible code execution on the server.

A flaw was found in libssh client-side ProxyCommand handling. In sshsocketconnectproxycommand() in src/socket.c, the return value of fork() was not checked before being stored as the proxy child PID. If fork() fails, the value -1 can be retained in state and later used during cleanup, causing signals to be sent across the caller's accessible process tree. In deployments that use ProxyCommand, this can lead to local denial of service.

A flaw was found in libssh server-side SFTP request handling. In sftpmakeclientmessage() and the downstream processread() path in src/sftpserver.c, the implementation accepts a client-controlled SSHFXPREAD length without enforcing a reasonable upper bound. The parsed len field later drives memory allocation in the SFTP server read path, so a remote authenticated client can request an excessively large read length and force the server to allocate excessive memory. Repeated requests can exhaust available memory and lead to denial of service.

A flaw was found in libssh username handling for ProxyCommand expansion. The sshcheckusernamesyntax() validation path in src/misc.c used an incomplete dangerous-character filter for usernames expanded through %r. As a result, specially crafted usernames containing shell-significant characters could reach shell-evaluated ProxyCommand handling and influence shell expansion, exposing environment variables and causing unintended shell behavior. This issue affects clients that combine untrusted username input with ProxyCommand-style shell execution.

A flaw was found in libssh username handling for ProxyCommand expansion. The sshcheckusernamesyntax() validation path in src/misc.c used an incomplete dangerous-character filter for usernames expanded through %r. As a result, specially crafted usernames containing shell-significant characters could reach shell-evaluated ProxyCommand handling and influence shell expansion, exposing environment variables and causing unintended shell behavior. This issue affects clients that combine untrusted username input with ProxyCommand-style shell execution.

A flaw was found in libssh builds using the OpenSSL backend for AES-GCM. In the decrypt path in src/libcrypto.c, the return value from EVPDecryptFinal() was checked incorrectly, so authentication tag verification failures were not handled as integrity failures. This could effectively remove integrity protection for affected AES-GCM sessions and allow an in-path attacker to modify plaintext on the wire without detection.

A flaw was found in libssh client-side SFTP message handling. In sftpgetmessage() in src/sftpcommon.c, SFTP responses carrying unknown request IDs were accepted and kept queued instead of being rejected. A malicious SFTP server can repeatedly send responses for request IDs that were never issued by the client, causing unbounded growth of queued messages and leading to client-side memory exhaustion and denial of service.

A flaw was found in libssh server-side GSSAPIKeyExchange authorization. In sshpacketuserauthrequest() in src/messages.c, the gssapi-keyex login path granted success after Kerberos authentication without dispatching the callback that verifies whether the authenticated principal is authorized for the requested local user. On servers with GSSAPIKeyExchange enabled, an authenticated client can therefore log in as an arbitrary local user if the missing principal-to-user authorization check is relied upon for access control.

A flaw was found in libssh automatic certificate-based public key authentication. In sshuserauthpublickeyauto() in src/auth.c, the iterator over certificate candidates was not advanced correctly when configured certificates were missing or repeatedly rejected by the server. Under specific non-default certificate configurations, this could cause the client to restart the same authentication attempts indefinitely, leading to denial of service.

A flaw was found in libssh channel data handling. In channelrcvdata() in src/channels.c, incoming channel DATA messages could still be processed after the channel had already been marked as remotely closed. In SFTP-backed applications and other callback-driven consumers, this creates a path where data callbacks may observe channel-associated state after it has already been torn down or freed, leading to crashes and possible use-after-free conditions.

A flaw was found in libssh server-side GSSAPIKeyExchange authorization. In sshpacketuserauthrequest() in src/messages.c, the gssapi-keyex login path granted success after Kerberos authentication without dispatching the callback that verifies whether the authenticated principal is authorized for the requested local user. On servers with GSSAPIKeyExchange enabled, an authenticated client can therefore log in as an arbitrary local user if the missing principal-to-user authorization check is relied upon for access control.

A flaw was found in libssh automatic certificate-based public key authentication. In sshuserauthpublickeyauto() in src/auth.c, the iterator over certificate candidates was not advanced correctly when configured certificates were missing or repeatedly rejected by the server. Under specific non-default certificate configurations, this could cause the client to restart the same authentication attempts indefinitely, leading to denial of service.

A flaw was found in libssh channel handling. In sshpacketchannelopen() in src/messages.c and sshpacketchannelopenconf() in src/channels.c, the implementation accepts a peer-controlled maximum packet size of 0 in channel open messages. That zero value is stored in channel state and later reaches channelwritecommon(), where forward progress depends on the remote maximum packet size being positive; with 0, the remaining length is never reduced and the write path loops indefinitely, consuming CPU and causing denial of service. A remote authenticated peer can trigger this by advertising a zero maximum packet size in SSHMSGCHANNELOPEN or SSHMSGCHANNELOPENCONFIRMATION.

A flaw was found in libssh channel handling. In sshpacketchannelopen() in src/messages.c and sshpacketchannelopenconf() in src/channels.c, the implementation accepts a peer-controlled maximum packet size of 0 in channel open messages. That zero value is stored in channel state and later reaches channelwritecommon(), where forward progress depends on the remote maximum packet size being positive; with 0, the remaining length is never reduced and the write path loops indefinitely, consuming CPU and causing denial of service. A remote authenticated peer can trigger this by advertising a zero maximum packet size in SSHMSGCHANNELOPEN or SSHMSGCHANNELOPENCONFIRMATION.

A flaw was found in libssh in the server-side GSSAPI Curve25519 key exchange path in src/kex-gss.c. In sshservergsskexprocessinit(), a client-controlled SSH string is unpacked into clientpubkey and then copied with memcpy(..., CURVE25519PUBKEYSIZE) without validating sshstringlen(clientpubkey). A remote unauthenticated client can send a short public key in SSHMSGKEXGSSINIT and trigger an out-of-bounds heap read during handshake processing, disclosing small amounts of adjacent server memory.

A flaw was found in libssh in the server-side GSSAPI Curve25519 key exchange path in src/kex-gss.c. In sshservergsskexprocessinit(), a client-controlled SSH string is unpacked into clientpubkey and then copied with memcpy(..., CURVE25519PUBKEYSIZE) without validating sshstringlen(clientpubkey). A remote unauthenticated client can send a short public key in SSHMSGKEXGSSINIT and trigger an out-of-bounds heap read during handshake processing, disclosing small amounts of adjacent server memory.

A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftpextensionsgetname/sftpextensionsgetdata of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component.

A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an SSHFXPNAME message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can cause unexpected behavior or lead to a denial of service (DoS) due to application crashes.

A malicious SFTP server can send malformed longname field of the SSHFXPNAME message (file listing). Due to the missing NULL check, the libssh could read beyond the buffer bounds on heap, causing unexpected behavior or crashes.

A flaw was found in libssh. A remote attacker, by controlling client configuration files or knownhosts files, could craft specific hostnames that when processed by the matchpattern() function can lead to inefficient regular expression backtracking. This can cause timeouts and resource exhaustion, resulting in a Denial of Service (DoS) for the client.

A flaw was found in libssh where it can attempt to open arbitrary files during configuration parsing. A local attacker can exploit this by providing a malicious configuration file or when the system is misconfigured. This vulnerability could lead to a Denial of Service (DoS) by causing the system to try and access dangerous files, such as block devices or large system files, which can disrupt normal operations.

libssh can try to open any file during configuration parsing, when misconfigured or when local attacker can provide malicious configuration. This applies for all configuration loaded from default location, configuration provided through the sshconfigparsefile() and sshbindconfigparsefile() functions as well as configuration files included from them directly or through glob wildcards.

The possibly dangerous files involve block devices, fifo, named pipe or huge system files that could cause Denial of Service.

The solution here is allowing to read only regular files and enforcing configuration file size limit of 16MB. Currently, maximum line length of a configuration file is 1K so this will effectively mean configuration files of 16K lines should still keep working.

A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory. This could be misused to create malicious executable or configuration files and make the user execute them under specific consequences.

This is the same issue as in OpenSSH, tracked as CVE-2019-6111.

A flaw was found in libssh. The API function sshgethexa() is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI (Generic Security Service Application Program Interface) authentication if the server's logging verbosity is set to SSHLOGPACKET (3) or higher. Successful exploitation could lead to a self-Denial of Service of the per-connection daemon process.

A flaw was found in libssh. This vulnerability allows local man-in-the-middle attacks, security downgrades of SSH (Secure Shell) connections, and manipulation of trusted host information, posing a significant risk to the confidentiality, integrity, and availability of SSH communications via an insecure default configuration on Windows systems where the library automatically loads configuration files from the C:\etc directory, which can be created and modified by unprivileged local users.

An insecure default configuration vulnerability exists in libssh on Windows systems where the library automatically loads configuration files from the C:\etc directory. Since this directory can be created and modified by unprivileged local users, an attacker can inject malicious SSH configuration or known-hosts entries. This enables local man-in-the-middle attacks, security downgrades of SSH connections, and manipulation of trusted host information. Exploitation requires only low privileges and no user interaction, posing a significant risk to the confidentiality, integrity, and availability of SSH communications that rely on libssh.

A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends incorrect KEX guesses. The library fails to free memory during these rekey operations, which can gradually exhaust system memory. This issue can lead to crashes on the client side, particularly when using libgcrypt, which impacts application stability and availability.

Memory Exhaustion vulnerability in the key exchange logic of the libssh library. When an authenticated client repeatedly performs rekeying with incorrect firstkexpacketfollows guesses, libssh allocates new ephemeral key pairs without freeing old ones stored in session->nextcrypto. Over time, this results in a memory leak that can exhaust system memory and cause a client-side denial-of-service (DoS). This flaw affects several KEX algorithms (Curve25519, ECDH, sntrup761x25519, DH-GEX) across multiple crypto backends (libgcrypt, OpenSSL, mbedTLS). The issue requires an authenticated client and does not impact the server side. Versions Affected : libssh >= 0.6.0

: null pointer dereference in libssh kex session id calculation