CVE-2026-59844: libssh SFTP Server DoS Vulnerability

CVE-2026-59844 Overview

A memory allocation flaw exists in libssh that allows a remote authenticated client to exhaust server memory through crafted SFTP read requests. An attacker with valid credentials can issue SSH_FXP_READ requests specifying an arbitrarily large length parameter. The libssh SFTP server allocates memory proportional to the requested length without adequate bounds enforcement. Repeated requests exhaust available memory, degrading or terminating the SFTP service. The issue is tracked as [CWE-789: Memory Allocation with Excessive Size Value] and carries a CVSS score of 6.5. The EPSS score is 0.536% at the 41.9 percentile as of the assessment date.

Critical Impact
Authenticated remote attackers can trigger sustained memory exhaustion against libssh-based SFTP servers, resulting in denial of service for legitimate users.

Affected Products

libssh SFTP server component (see Red Hat advisory for specific package versions)
Red Hat Enterprise Linux distributions referenced in RHSA-2026:42922
Downstream applications embedding vulnerable libssh releases as an SFTP server

Discovery Timeline

2026-07-21 - CVE-2026-59844 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-59844

Vulnerability Analysis

The vulnerability resides in the SFTP subsystem of libssh. The SFTP protocol defines the SSH_FXP_READ request, which specifies an offset and a length of data the client wishes to read from an open file handle. The libssh server implementation trusts the client-supplied length value when allocating a buffer for the read response.

An authenticated attacker submits SSH_FXP_READ messages containing very large length fields. Each request causes the server to allocate a correspondingly large buffer. By pipelining or repeating these requests across one or more sessions, the attacker forces the server process to consume all available heap memory. The condition results in denial of service against the SFTP service and any co-hosted workloads on the same host.

The attack requires only low-privilege authenticated access. Any account able to open the SFTP subsystem qualifies. The impact is limited to availability; confidentiality and integrity are not directly affected.

Root Cause

The root cause is missing validation on the client-controlled length parameter of SSH_FXP_READ before invoking memory allocation. The server should cap allocation size against a protocol-appropriate ceiling and reject or truncate oversized read requests instead of honoring arbitrary values.

Attack Vector

Exploitation occurs over the network across an authenticated SSH session. The attacker authenticates to the SFTP server, opens any file handle, and sends SSH_FXP_READ packets with inflated length values. No user interaction is required, and the attack complexity is low.

No verified proof-of-concept code is publicly available. Refer to the Red Hat CVE record and Bugzilla #2498177 for upstream technical detail.

Detection Methods for CVE-2026-59844

Indicators of Compromise

Rapid growth in resident memory of the sshd or libssh-backed SFTP server process, followed by out-of-memory (OOM) kill events in system logs.
SFTP session logs showing repeated SSH_FXP_READ requests from a single authenticated principal within a short window.
Unexpected SFTP service restarts or systemd oom-kill messages referencing the SFTP daemon.

Detection Strategies

Enable SFTP subsystem verbose logging and parse for high-frequency read operations tied to a single session identifier.
Correlate authentication events with abnormal memory pressure on hosts running libssh SFTP servers.
Alert on Linux kernel OOM killer entries in dmesg and journalctl output that terminate SSH or SFTP processes.

Monitoring Recommendations

Track per-process memory metrics for the SFTP daemon with thresholds tuned to normal working sets.
Monitor authenticated SFTP session counts and read-request rates per user, flagging deviations from baseline.
Forward SSH and SFTP logs to a centralized analytics platform for retention and cross-host correlation.

How to Mitigate CVE-2026-59844

Immediate Actions Required

Apply the vendor-supplied libssh update referenced in RHSA-2026:42922 or the equivalent package from your distribution.
Restart all services that link against libssh after patching to ensure the vulnerable code is unloaded from memory.
Audit SFTP user accounts and disable or rotate credentials for any account not required for business operations.

Patch Information

Red Hat has published fixed packages via RHSA-2026:42922. Consult the Red Hat CVE page for CVE-2026-59844 for the mapping of affected and fixed component versions. Non-Red Hat consumers of libssh should track the upstream project release notes and rebuild dependent binaries against a fixed library.

Workarounds

Restrict SFTP access to trusted networks using firewall rules or SSH AllowUsers/Match directives until patching is complete.
Apply per-process memory limits with systemdMemoryMax= or ulimit -v to contain the blast radius of memory exhaustion.
Rate-limit new SSH connections and authenticated sessions at the network edge to slow repeated exploitation attempts.

bash

# Example: cap SFTP daemon memory via a systemd drop-in
sudo systemctl edit sshd.service
# Add the following lines:
# [Service]
# MemoryMax=512M
# TasksMax=256
sudo systemctl daemon-reload
sudo systemctl restart sshd