CVE-2026-59848: Libssh: libssh: denial of service via sftp responses with unknown request ids
Published Jul 8, 2026
·Updated
A flaw was found in libssh client-side SFTP message handling. In sftpgetmessage() in src/sftpcommon.c, SFTP responses carrying unknown request IDs were accepted and kept queued instead of being rejected. A malicious SFTP server can repeatedly send responses for request IDs that were never issued by the client, causing unbounded growth of queued messages and leading to client-side memory exhaustion and denial of service.
Other sources
A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service.
— MITRE
Affected Software
1 affected component
libssh libssh
Event History
Jul 8, 2026
Data Sourced
via Red Hat·06:22 PM
DescriptionSeverityAffected Software
Jul 21, 2026
CVE Published
via MITRE·01:21 PM
Data Sourced
via MITRE·01:21 PM
DescriptionSeverity
Data Sourced
via NVD·02:16 PM
DescriptionSeverityWeakness