CVE-2026-15370

EUVD-2026-46169
A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list attacker-controlled filenames, sufficiently long names can overflow that stack buffer and may lead to crashes or possible code execution on the server.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.7 MEDIUM
LOCAL
HIGH
LOW
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 5.61%
Affected Products (NVD)
VendorProductVersion
libsshlibssh
0.11.0 ≤
𝑥
< 0.11.5
libsshlibssh
0.12.0
redhathardened_images
-
redhatenterprise_linux
10.0
redhatenterprise_linux
10.0
redhatenterprise_linux
10.2
redhatenterprise_linux_for_els
10.2
redhatenterprise_linux_for_eus
10.2
redhatenterprise_linux_for_ibm_z_systems
10.0
redhatenterprise_linux_for_ibm_z_systems
10.2
redhatenterprise_linux_for_ibm_z_systems_els
10.2
redhatenterprise_linux_for_ibm_z_systems_eus
10.2
redhatenterprise_linux_for_power_little_endian
10.0
redhatenterprise_linux_for_power_little_endian
10.2
redhatenterprise_linux_for_power_little_endian_els
10.2
redhatenterprise_linux_for_power_little_endian_eus
10.2
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
libssh
bookworm
vulnerable
bookworm (security)
vulnerable
forky
0.12.2-1
fixed
sid
0.12.2-1
fixed
trixie
0.11.5-0+deb13u1
fixed
trixie (security)
0.11.5-0+deb13u1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libssh
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
not-affected
resolute
Fixed 0.11.3-1ubuntu2.1
released
xenial
not-affected
Common Weakness Enumeration
References
https://access.redhat.com/errata/RHSA-2026:47768
https://access.redhat.com/errata/RHSA-2026:55855
https://access.redhat.com/security/cve/CVE-2026-15370
https://bugzilla.redhat.com/show_bug.cgi?id=2499049