Loading vulnerability…
Stack buffer overflow in libssh SFTP server longname construction
CVE-2026-15370 is a stack-based buffer overflow in libssh's SFTP server directory-listing functionality. The server constructs the longname field of directory entries using unsafe concatenation into a fixed-size stack buffer. Processing sufficiently long attacker-controlled filenames can overflow the buffer, potentially crashing the server or enabling arbitrary code execution. The vulnerability is fixed in upstream libssh 0.12.1 and 0.11.5.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation can corrupt stack memory in the application providing the libssh-based SFTP service, causing a crash and denial of service. Successful exploitation may also permit arbitrary code execution within the server process's security context; code execution is a potential outcome rather than a confirmed capability.
If you can’t patch tonight, do this now.
Until patched, disable affected libssh-based SFTP server functionality where feasible or restrict it to trusted users and networks. Prevent untrusted users from introducing attacker-controlled filenames into directories that the affected server can list. These measures reduce exposure but do not correct the buffer overflow.
Patch, then assume compromise.
Upgrade to libssh 0.12.1 on the 0.12 branch or 0.11.5 on the 0.11 branch, or install the applicable distribution security update. Fixed distribution packages include libssh-4 0.11.3-1ubuntu2.1 for Ubuntu 26.04 LTS, libssh 0.11.5-0+deb13u1 for Debian 13 (trixie), and libssh 0.12.0-3.el10_2 for the applicable RHEL 10 release. Among the Ubuntu releases covered by USN-8699-1, this specific vulnerability affects only Ubuntu 26.04 LTS.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.