Loading vulnerability…
Authenticated memory-exhaustion DoS in libssh SFTP server
CVE-2026-59844 is an uncontrolled memory-allocation vulnerability in the libssh SFTP server implementation. The server insufficiently limits the requested read length in SSH_FXP_READ messages, allowing a remote authenticated client to request arbitrarily large allocations. Repeated oversized requests can exhaust server memory and cause denial of service.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation can cause excessive memory consumption and potentially exhaust available memory, disrupting the affected SFTP service. The vulnerability has a CVSS v3.0 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting high availability impact with no identified confidentiality or integrity impact. Code execution and privilege escalation are not established consequences of this vulnerability.
If you can’t patch tonight, do this now.
Until patched, restrict the SFTP service to trusted authenticated users and limit network access to trusted sources. Enforce connection and request-rate limits, monitor for oversized or repeated SFTP read requests, and apply memory limits to the SFTP server process where operationally feasible. These controls can reduce exposure or contain resource consumption but do not correct the missing read-length limit.
Patch, then assume compromise.
Install the vendor-provided libssh security update for the affected operating system. Fixed package releases include 0.9.6-17.el8_10 for RHEL 8, 0.10.4-19.el9_8 for RHEL 9, and 0.12.0-3.el10_2 for RHEL 10. Ubuntu 26.04 LTS provides the fix in libssh-4 version 0.11.3-1ubuntu2.1; among the Ubuntu releases covered by USN-8699-1, this vulnerability affects only Ubuntu 26.04 LTS. Debian trixie provides an update in version 0.11.5-0+deb13u1. Use the applicable distribution advisory rather than treating these package versions as universal upstream version thresholds.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
27 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.