CVE-2026-0968

EUVD-2026-16335
A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an `SSH_FXP_NAME` message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can cause unexpected behavior or lead to a denial of service (DoS) due to application crashes.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
3.1 LOW
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 1%
Affected Products (NVD)
VendorProductVersion
libsshlibssh
𝑥
≤ 0.11.3
redhatenterprise_linux
9.0
redhatenterprise_linux
10.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
libssh
bookworm
no-dsa
bookworm (security)
vulnerable
bullseye
postponed
bullseye (security)
vulnerable
forky
0.12.0-3
fixed
sid
0.12.0-3
fixed
trixie
no-dsa
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libssh-config
suse enterprise desktop 15 SP7
0.9.8-150600.11.9.1
fixed
suse enterprise sap 15 SP7
0.9.8-150600.11.9.1
fixed
suse enterprise server 15 SP4
0.9.8-150400.3.17.1
fixed
suse enterprise server 15 SP7
0.9.8-150600.11.9.1
fixed
libssh-devel
suse enterprise desktop 15 SP7
0.9.8-150600.11.9.1
fixed
suse enterprise sap 15 SP7
0.9.8-150600.11.9.1
fixed
suse enterprise server 15 SP4
0.9.8-150400.3.17.1
fixed
suse enterprise server 15 SP7
0.9.8-150600.11.9.1
fixed
libssh4
suse enterprise desktop 15 SP7
0.9.8-150600.11.9.1
fixed
suse enterprise sap 15 SP7
0.9.8-150600.11.9.1
fixed
suse enterprise server 15 SP4
0.9.8-150400.3.17.1
fixed
suse enterprise server 15 SP7
0.9.8-150600.11.9.1
fixed
libssh4-32bit
suse enterprise desktop 15 SP7
0.9.8-150600.11.9.1
fixed
suse enterprise sap 15 SP7
0.9.8-150600.11.9.1
fixed
suse enterprise server 15 SP4
0.9.8-150400.3.17.1
fixed
suse enterprise server 15 SP7
0.9.8-150600.11.9.1
fixed
Common Weakness Enumeration
References
https://access.redhat.com/security/cve/CVE-2026-0968
https://bugzilla.redhat.com/show_bug.cgi?id=2436982
https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/