Loading vulnerability…
libssh SFTP Client Memory Exhaustion via Unknown Request IDs
CVE-2026-59848 is an uncontrolled resource consumption vulnerability in libssh's SFTP client response handling. A malicious SFTP server can send responses containing request IDs that do not correspond to outstanding client requests. Affected clients retain these responses in a queue indefinitely, allowing repeated responses to cause unbounded memory growth and client-side denial of service.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation can exhaust memory in an affected SFTP client, disrupt applications using libssh, or cause unexpected termination of an SFTP connection. The vulnerability affects availability; no confidentiality or integrity impact is identified.
If you can’t patch tonight, do this now.
Avoid connecting affected libssh-based SFTP clients to untrusted SFTP servers. In particular, do not configure affected F5OS systems to connect to untrusted SFTP servers.
Patch, then assume compromise.
Install the applicable vendor-fixed libssh packages. Fixed releases include Ubuntu 22.04 LTS 0.9.6-2ubuntu0.22.04.8, Ubuntu 24.04 LTS 0.10.6-2ubuntu0.5, Ubuntu 26.04 LTS 0.11.3-1ubuntu2.1, Debian 13 0.11.5-0+deb13u1, RHEL 8 0.9.6-17.el8_10, RHEL 9 0.10.4-19.el9_8, and RHEL 10 0.12.0-3.el10_2. For F5OS 2.0.0, no fixed release is identified; apply a vendor-provided fix when available.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
32 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.