CVE-2026-0968

EUVD-2026-16335
A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an `SSH_FXP_NAME` message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can cause unexpected behavior or lead to a denial of service (DoS) due to application crashes.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
3.1 LOW
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 36.37%
Affected Products (NVD)
VendorProductVersion
libsshlibssh
𝑥
≤ 0.11.3
redhatenterprise_linux
9.0
redhatenterprise_linux
10.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
libssh
bookworm
no-dsa
bookworm (security)
vulnerable
bullseye
postponed
bullseye (security)
vulnerable
forky
0.12.2-1
fixed
sid
0.12.2-1
fixed
trixie
vulnerable
trixie (security)
0.11.5-0+deb13u1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libssh
bionic
Fixed 0.8.0~20170825.94fa1e38-1ubuntu0.7+esm6
released
focal
Fixed 0.9.3-2ubuntu2.5+esm3
released
jammy
Fixed 0.9.6-2ubuntu0.22.04.6
released
noble
Fixed 0.10.6-2ubuntu0.3
released
questing
Fixed 0.11.2-1ubuntu0.2
released
xenial
Fixed 0.6.3-4.3ubuntu0.6+esm4
released
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libssh-config
suse enterprise desktop 15 SP7
0.9.8-150600.11.9.1
fixed
suse enterprise sap 15 SP7
0.9.8-150600.11.9.1
fixed
suse enterprise server 15 SP4
0.9.8-150400.3.17.1
fixed
suse enterprise server 15 SP7
0.9.8-150600.11.9.1
fixed
libssh-devel
suse enterprise desktop 15 SP7
0.9.8-150600.11.9.1
fixed
suse enterprise sap 15 SP7
0.9.8-150600.11.9.1
fixed
suse enterprise server 15 SP4
0.9.8-150400.3.17.1
fixed
suse enterprise server 15 SP7
0.9.8-150600.11.9.1
fixed
libssh4
suse enterprise desktop 15 SP7
0.9.8-150600.11.9.1
fixed
suse enterprise sap 15 SP7
0.9.8-150600.11.9.1
fixed
suse enterprise server 15 SP4
0.9.8-150400.3.17.1
fixed
suse enterprise server 15 SP7
0.9.8-150600.11.9.1
fixed
libssh4-32bit
suse enterprise desktop 15 SP7
0.9.8-150600.11.9.1
fixed
suse enterprise sap 15 SP7
0.9.8-150600.11.9.1
fixed
suse enterprise server 15 SP4
0.9.8-150400.3.17.1
fixed
suse enterprise server 15 SP7
0.9.8-150600.11.9.1
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
libssh
RHEL 9
0:0.10.4-18.el9
fixed
libssh-config
RHEL 9
0:0.10.4-18.el9
fixed
libssh-devel
RHEL 9
0:0.10.4-18.el9
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
libssh
Amazon Linux 2023
0:0.10.6-1.amzn2023.0.6
fixed
libssh-config
Amazon Linux 2023
0:0.10.6-1.amzn2023.0.6
fixed
libssh-debuginfo
Amazon Linux 2023
0:0.10.6-1.amzn2023.0.6
fixed
libssh-debugsource
Amazon Linux 2023
0:0.10.6-1.amzn2023.0.6
fixed
libssh-devel
Amazon Linux 2023
0:0.10.6-1.amzn2023.0.6
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
libssh
Azure Linux 3.0
0:0.10.6-8.azl3
fixed
Common Weakness Enumeration
References
https://access.redhat.com/errata/RHSA-2026:18160
https://access.redhat.com/errata/RHSA-2026:18683
https://access.redhat.com/security/cve/CVE-2026-0968
https://bugzilla.redhat.com/show_bug.cgi?id=2436982
https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/