CVE-2026-59844: Libssh: libssh: denial of service via oversized sftp read length
A flaw was found in libssh server-side SFTP request handling. In sftpmakeclientmessage() and the downstream processread() path in src/sftpserver.c, the implementation accepts a client-controlled SSHFXPREAD length without enforcing a reasonable upper bound. The parsed len field later drives memory allocation in the SFTP server read path, so a remote authenticated client can request an excessively large read length and force the server to allocate excessive memory. Repeated requests can exhaust available memory and lead to denial of service.
Other sources
A flaw was found in libssh. A remote authenticated client can issue SSHFXPREAD requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59844?
CVE-2026-59844 has a medium severity rating of 6.5.
How do I fix CVE-2026-59844?
To fix CVE-2026-59844, update your libssh version to the latest release that addresses this vulnerability.
What is the impact of CVE-2026-59844?
CVE-2026-59844 can lead to a denial of service by exhausting server memory via oversized SFTP read length requests.
Who is affected by CVE-2026-59844?
Any libssh SFTP server that allows remote authenticated clients to send SSH_FXP_READ requests is affected by CVE-2026-59844.
What type of vulnerability is CVE-2026-59844?
CVE-2026-59844 is a denial of service vulnerability specifically related to memory allocation in libssh.