CVE-2026-0968: libssh SFTP DoS Vulnerability Explained

CVE-2026-0968 Overview

A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an SSH_FXP_NAME message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can cause unexpected behavior or lead to a denial of service (DoS) due to application crashes.

Critical Impact

A malicious SFTP server can crash client applications by sending specially crafted responses during file listing operations, resulting in denial of service conditions.

Affected Products

• libssh versions prior to 0.12.0
• libssh versions prior to 0.11.4
• Applications using vulnerable libssh versions for SFTP client functionality

Discovery Timeline

• 2026-02-10 - libssh releases security patches (versions 0.12.0 and 0.11.4)
• 2026-03-26 - CVE CVE-2026-0968 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-0968

Vulnerability Analysis

This vulnerability is classified as CWE-476 (Null Pointer Dereference). The flaw exists in how libssh processes SFTP server responses, specifically when handling the SSH_FXP_NAME message type used during file listing operations. When a malicious server sends a response containing a malformed or missing 'longname' field, the libssh client code fails to properly validate the presence of this field before attempting to access it.

The missing null check allows the code to proceed with an invalid memory reference, leading to an out-of-bounds read on the heap. While this vulnerability requires user interaction (connecting to a malicious server) and network-level access, successful exploitation results in application crashes and denial of service.

Root Cause

The root cause is a missing null check in the SFTP client implementation when processing SSH_FXP_NAME messages. The code assumes the 'longname' field will always be present and properly formatted in server responses, failing to validate this assumption before dereferencing the pointer. This lack of defensive programming allows a malicious server to trigger undefined behavior by omitting or malforming this expected field.

Attack Vector

The attack requires a victim to connect to a malicious SFTP server controlled by the attacker. When the client initiates a file listing operation (such as listing directory contents), the malicious server responds with a crafted SSH_FXP_NAME message containing a malformed 'longname' field. The libssh client processes this response without adequate validation, triggering a heap out-of-bounds read that crashes the application.

This attack scenario requires user interaction to initiate the connection and has high attack complexity since the attacker must operate a malicious SFTP server and convince the victim to connect to it.

Detection Methods for CVE-2026-0968

Indicators of Compromise

• Unexpected crashes of SFTP client applications using libssh
• Application logs showing segmentation faults or access violations during SFTP operations
• Core dumps indicating memory access violations in libssh library functions

Detection Strategies

• Monitor for abnormal termination of applications using libssh for SFTP functionality
• Implement application-level logging to capture SFTP operation failures
• Deploy network monitoring to identify connections to untrusted or suspicious SFTP servers

Monitoring Recommendations

• Audit systems for vulnerable versions of libssh (versions prior to 0.12.0 and 0.11.4)
• Enable crash reporting mechanisms to capture and analyze application failures
• Review network logs for SFTP connections to unknown or untrusted servers

How to Mitigate CVE-2026-0968

Immediate Actions Required

• Update libssh to version 0.12.0 or 0.11.4 (security releases)
• Identify and inventory all applications using libssh for SFTP client functionality
• Restrict SFTP connections to trusted and verified servers only
• Consider implementing network-level controls to limit outbound SFTP connections

Patch Information

Security patches have been released by the libssh project. According to the Libssh Security Release Announcement, versions 0.12.0 and 0.11.4 address this vulnerability. Red Hat has also published an advisory available at the Red Hat CVE-2026-0968 Advisory page. Additional technical details can be found in Red Hat Bug Report #2436982.

Workarounds

• Avoid connecting to untrusted or unknown SFTP servers until patches can be applied
• Implement strict allowlisting of SFTP server destinations at the network or application level
• Deploy application sandboxing to contain potential crash impacts
• Consider using alternative SSH/SFTP libraries if immediate patching is not feasible

# Configuration example
# Check installed libssh version
pkg-config --modversion libssh

# On RHEL/CentOS/Fedora, update libssh
sudo dnf update libssh

# On Debian/Ubuntu, update libssh
sudo apt update && sudo apt upgrade libssh-4