libssh SFTP longname NullCheck: Heap OverRead -> DoS
CVE-2026-0968 Published on March 26, 2026
Libssh: libssh: denial of service due to malformed sftp message
A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an `SSH_FXP_NAME` message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can cause unexpected behavior or lead to a denial of service (DoS) due to application crashes.
Timeline
Reported to Red Hat.
Made public. 6 days later.
Weakness Type
NULL Pointer Dereference
A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. NULL pointer dereference issues can occur through a number of flaws, including race conditions, and simple programming omissions.
Products Associated with CVE-2026-0968
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-0968 are published in these products:
