Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in libssh client-side SFTP message handling. In sftp_get_message() in src/sftp_common.c, SFTP responses carrying unknown request IDs were accepted and kept queued instead of being rejected. A malicious SFTP server can repeatedly send responses for request IDs that were never issued by the client, causing unbounded growth of queued messages and leading to client-side memory exhaustion and denial of service.