Bug 2503658

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in libssh server-side SFTP request handling. In sftp_make_client_message() and the downstream process_read() path in src/sftpserver.c, the implementation accepts a client-controlled SSH_FXP_READ length without enforcing a reasonable upper bound. The parsed len field later drives memory allocation in the SFTP server read path, so a remote authenticated client can request an excessively large read length and force the server to allocate excessive memory. Repeated requests can exhaust available memory and lead to denial of service.