Bug 2498177 (CVE-2026-59844)

Summary: CVE-2026-59844 libssh: libssh: denial of service via oversized SFTP read length
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, security-response-team, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2503658    
Bug Blocks:    

Description OSIDB Bzimport 2026-07-08 18:22:42 UTC 
A flaw was found in libssh server-side SFTP request handling. In sftp_make_client_message() and the downstream process_read() path in src/sftpserver.c, the implementation accepts a client-controlled SSH_FXP_READ length without enforcing a reasonable upper bound. The parsed len field later drives memory allocation in the SFTP server read path, so a remote authenticated client can request an excessively large read length and force the server to allocate excessive memory. Repeated requests can exhaust available memory and lead to denial of service.
Comment 5 errata-xmlrpc 2026-08-17 20:53:25 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:55855 https://access.redhat.com/errata/RHSA-2026:55855
Comment 6 errata-xmlrpc 2026-09-01 17:53:30 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:62217 https://access.redhat.com/errata/RHSA-2026:62217
Comment 7 errata-xmlrpc 2026-09-01 18:33:11 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:62218 https://access.redhat.com/errata/RHSA-2026:62218