cve-2026-0968

LOW CVSS 3.1 nvd
Description

A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an `SSH_FXP_NAME` message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can cause unexpected behavior or lead to a denial of service (DoS) due to application crashes.

Timeline
Published
2026-03-26
Last Modified
2026-09-01
CVSS Details
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
Affected Products
  • libssh libssh
  • redhat enterprise_linux
Weaknesses (CWE)
CWE-476
CVSS metrics
Version Base Severity Vector Exploitability Impact Source
3.1 3.1 LOW CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L 1.6 1.4 secalert@redhat.com
3.1 3.1 LOW CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L 1.6 1.4 nvd@nist.gov
CPE configurations
OR
CPE Version range Vulnerable
cpe:2.3:a:libssh:libssh:*:*:*:*:*:*:*:* <= 0.11.3 yes
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* — yes
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:* — yes
NVD metadata
NVD status
Modified
Source identifier
secalert@redhat.com
References
Linked Vulnerabilities
alas2023-2026-1632 amazon_linux
azurelinux3-81849 azure_linux
elsa-2026-18160 oracle_linux
elsa-2026-18683 oracle_linux
cpujul2026csaf csaf_oracle
cspuaug2026csaf csaf_oracle 

{
  "cvss": 3.1,
  "datePublished": "2026-03-26T21:17:01.150",
  "dateUpdated": "2026-09-01T13:18:07.090",
  "description": "A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an `SSH_FXP_NAME` message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can cause unexpected behavior or lead to a denial of service (DoS) due to application crashes.",
  "id": "CVE-2026-0968",
  "raw": {
    "affected": [
      {
        "affectedData": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "libssh",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.12.0-2.el10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9::appstream",
              "cpe:/o:redhat:enterprise_linux:9::baseos"
            ],
            "defaultStatus": "affected",
            "packageName": "libssh",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.10.4-18.el9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9::appstream",
              "cpe:/o:redhat:enterprise_linux:9::baseos"
            ],
            "defaultStatus": "affected",
            "packageName": "libssh",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.10.4-18.el9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "libssh2",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "libssh2",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "libssh",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "libssh2",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift/ose-rhel-coreos-8",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift/ose-rhel-coreos-9",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          }
        ],
        "source": "secalert@redhat.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:libssh:libssh:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "2366D711-FD0B-4A04-92BA-DE6DA0ED1BCF",
                "versionEndIncluding": "0.11.3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*",
                "matchCriteriaId": "7F6FB57C-2BC7-487C-96DD-132683AEB35D",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*",
                "matchCriteriaId": "D65C2163-CFC2-4ABB-8F4E-CB09CEBD006C",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an `SSH_FXP_NAME` message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can cause unexpected behavior or lead to a denial of service (DoS) due to application crashes."
      },
      {
        "lang": "es",
        "value": "Se encontró una falla en libssh en la que un servidor SFTP (Protocolo de Transferencia de Archivos SSH) malicioso puede explotar esto enviando un campo 'longname' malformado dentro de un mensaje 'SSH_FXP_NAME' durante una operación de listado de archivos. Esta falta de verificación de nulos puede llevar a leer más allá de la memoria asignada en el heap. Esto puede causar un comportamiento inesperado o llevar a una denegación de servicio (DoS) debido a fallos de la aplicación."
      }
    ],
    "id": "CVE-2026-0968",
    "lastModified": "2026-09-01T13:18:07.090",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "exploitabilityScore": 1.6,
          "impactScore": 1.4,
          "source": "secalert@redhat.com",
          "type": "Secondary"
        },
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "exploitabilityScore": 1.6,
          "impactScore": 1.4,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-0968",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-03-27T20:21:00.402985Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-03-26T21:17:01.150",
    "references": [
      {
        "source": "secalert@redhat.com",
        "url": "https://access.redhat.com/errata/RHSA-2026:18160"
      },
      {
        "source": "secalert@redhat.com",
        "url": "https://access.redhat.com/errata/RHSA-2026:18683"
      },
      {
        "source": "secalert@redhat.com",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://access.redhat.com/security/cve/CVE-2026-0968"
      },
      {
        "source": "secalert@redhat.com",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436982"
      },
      {
        "source": "secalert@redhat.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/"
      }
    ],
    "sourceIdentifier": "secalert@redhat.com",
    "vulnStatus": "Modified",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-476"
          }
        ],
        "source": "secalert@redhat.com",
        "type": "Secondary"
      }
    ]
  },
  "severity": "LOW",
  "source": "nvd",
  "title": "A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending ..."
}
Enrichment data
EPSS
View JSON Download
CISA KEV
View JSON Download
Aggregated bundle (all enrichments)
View JSON API Download bundle
View JSON API Download JSON