CVE-2026-15370: libssh Buffer Overflow Vulnerability

CVE-2026-15370 Overview

A stack buffer overflow vulnerability exists in libssh affecting the SFTP server component. During directory listing operations, the server constructs the longname field using unsafe concatenation into a fixed-size stack buffer. Attacker-controlled filenames of sufficient length can overflow this buffer when a client requests a directory listing. Successful exploitation may lead to server crashes or arbitrary code execution in the context of the SFTP server process. The flaw is classified under CWE-121: Stack-based Buffer Overflow and requires local access with low privileges plus user interaction to trigger.

Critical Impact
Attackers with the ability to place files with long names in a directory served by the SFTP server can crash the server or potentially execute arbitrary code within the server process.

Affected Products

libssh library (SFTP server component)
Applications and services embedding vulnerable versions of libssh for SFTP server functionality
Linux distributions packaging affected libssh releases (see Red Hat CVE-2026-15370 Advisory)

Discovery Timeline

2026-07-21 - CVE-2026-15370 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-15370

Vulnerability Analysis

The vulnerability resides in the SFTP server directory listing code path within libssh. When a client issues an SSH_FXP_READDIR request, the server enumerates directory entries and builds a longname string for each file. This string mimics the output of ls -l and includes the filename supplied by the underlying filesystem.

The server constructs the longname field through unsafe concatenation into a fixed-size stack buffer. The code does not enforce bounds checking against the filename length before writing into the buffer. When a filename exceeds the buffer capacity, adjacent stack memory is overwritten, including saved return addresses and frame pointers.

Exploitation requires the attacker to influence filenames listed by the SFTP server. This typically means the attacker must be able to write files to a directory that a legitimate SFTP client will subsequently list. Impact ranges from process crashes and denial of service to potential code execution within the SFTP server context.

Root Cause

The root cause is the use of unbounded string concatenation into a fixed-size stack allocation when composing the longname field for SFTP directory entries. The affected routine trusts filename length without validating against the destination buffer size, violating safe string handling practices for untrusted input.

Attack Vector

An attacker with local, low-privileged access places files with excessively long names in a directory reachable through the SFTP server. When any client triggers a directory listing operation over an established SFTP session, the server processes the malicious filenames and overflows the stack buffer. User interaction is required, since the vulnerable code path executes only during a client-initiated READDIR operation. Refer to the Red Hat Bug Report #2499049 for additional technical context.

Detection Methods for CVE-2026-15370

Indicators of Compromise

Unexpected crashes, segmentation faults, or core dumps produced by SFTP server processes linked against libssh
Presence of files with unusually long names (approaching or exceeding 256 bytes) in directories served over SFTP
SFTP session terminations logged immediately after READDIR operations on suspicious directories

Detection Strategies

Inventory running processes and services that link against libssh and identify those exposing SFTP server functionality
Audit SFTP server logs for repeated client-initiated directory listings followed by abnormal process termination
Deploy runtime memory protection alerts on SFTP server binaries to catch stack corruption events

Monitoring Recommendations

Enable core dump collection for SFTP server processes and forward crash telemetry to a centralized log platform
Monitor filesystem write activity from low-privileged users into directories exposed through SFTP
Correlate SSH authentication events with subsequent SFTP subsystem crashes to identify triggering sessions

How to Mitigate CVE-2026-15370

Immediate Actions Required

Identify all systems running SFTP servers backed by libssh and prioritize patching for internet-exposed hosts
Restrict write access to SFTP-served directories so untrusted users cannot introduce attacker-controlled filenames
Apply vendor-supplied patches referenced in the Red Hat CVE-2026-15370 Advisory as they become available

Patch Information

Consult the Red Hat CVE-2026-15370 Advisory and the associated Red Hat Bug Report #2499049 for patched package versions across supported distributions. Rebuild any statically linked applications after updating libssh to ensure the fix is embedded. Restart SFTP server processes after installation so the patched library is loaded.

Workarounds

Disable the SFTP subsystem in affected servers where SFTP is not required for operations
Enforce filesystem-level filename length limits on directories served through SFTP to prevent overflow-triggering names
Constrain SFTP users to chrooted environments with strict write permissions to reduce attacker influence over directory contents

bash

# Example: disable SFTP subsystem in OpenSSH configurations that rely on libssh-backed helpers
# Edit /etc/ssh/sshd_config and comment the Subsystem line, then restart the service
# Subsystem sftp /usr/lib/openssh/sftp-server
sudo systemctl restart sshd