CVE-2026-59848

Published: Jul 21, 2026Modified: Sep 1, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Exploitability: 3.9 / Impact: 1.4

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service.

Affected (5)

Products: Libssh: Libssh · Redhat: Enterprise Linux, Hardened Images

1 product

2 products

Enterprise Linux

Hardened Images

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Libssh Libssh	All versions
Redhat Enterprise Linux	Version 10.0
Redhat Enterprise Linux	Version 8.0
Redhat Enterprise Linux	Version 9.0
Redhat Hardened Images	All versions

Related CWEs

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (6)

https://access.redhat.com/errata/RHSA-2026:42922

Source: secalert@redhat.com

Vendor Advisory

https://access.redhat.com/errata/RHSA-2026:55855

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2026:62217

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2026:62218

Source: secalert@redhat.com

https://access.redhat.com/security/cve/CVE-2026-59848

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2498181

Source: secalert@redhat.com

Issue TrackingVendor Advisory

Timeline

No history available yet.