CVE-2026-59848: libssh SFTP Client DoS Vulnerability

CVE-2026-59848 Overview

A flaw exists in libssh that allows a malicious SFTP server to exhaust memory on connected clients. When the server sends responses containing unknown request IDs, the client queues these responses indefinitely instead of discarding them. The unbounded queue growth leads to a client-side denial of service through memory consumption. The vulnerability is tracked under CWE-770: Allocation of Resources Without Limits or Throttling and affects any application using libssh as an SFTP client.

Critical Impact
A hostile SFTP server can force connecting libssh clients into unbounded memory growth, crashing the client process or degrading host stability.

Affected Products

libssh (SFTP client functionality)
Red Hat Enterprise Linux distributions shipping affected libssh builds
Downstream applications linking against vulnerable libssh versions

Discovery Timeline

2026-07-21 - CVE-2026-59848 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-59848

Vulnerability Analysis

The SSH File Transfer Protocol (SFTP) uses request identifiers to correlate client requests with server responses. A well-behaved server only returns responses that match pending client request IDs. The libssh client stores incoming server responses in an internal queue until the corresponding request handler consumes them.

The flaw is that libssh does not validate whether a received response corresponds to an outstanding request ID. Responses carrying unknown or unsolicited request IDs remain in the queue permanently, with no consumer and no eviction logic. A malicious server can therefore stream arbitrary response messages using fabricated request IDs, forcing the client to allocate memory indefinitely.

Root Cause

The root cause is missing bounds enforcement on the response queue combined with absent validation of server-supplied request identifiers. This maps directly to [CWE-770], where a resource, in this case the queued-response buffer, is allocated without an upper limit or lifecycle policy.

Attack Vector

Exploitation requires a client to initiate an SFTP session against an attacker-controlled or compromised server. This condition arises when users connect to malicious hosts, when man-in-the-middle attackers intercept sessions without host key verification, or when a legitimate server is compromised. No authentication of the client is required for the server to send response packets, and no user interaction beyond initiating the connection is needed. The impact is limited to availability, with confidentiality and integrity unaffected.

The vulnerability manifests in the SFTP response dispatch path where server messages are enqueued before request-ID correlation. See the Red Hat CVE-2026-59848 Details advisory for protocol-level analysis.

Detection Methods for CVE-2026-59848

Indicators of Compromise

Sustained memory growth in processes linking libssh while an SFTP session is active.
SFTP client processes terminated by the out-of-memory killer or crashing with allocation failures.
Long-lived SFTP connections to untrusted hosts accompanied by high inbound packet volume without matching client-side file transfer progress.

Detection Strategies

Inventory installed libssh versions across Linux hosts and compare against fixed builds referenced in RHSA-2026:42922.
Monitor resident set size (RSS) growth on processes that call into libssh, such as sftp, backup agents, and CI runners.
Inspect SFTP session telemetry for abnormal server-to-client message volume relative to file transfer size.

Monitoring Recommendations

Alert on process memory thresholds for known SFTP client binaries and library consumers.
Log outbound SFTP connections to non-corporate destinations and correlate with process memory anomalies.
Track package versions of libssh through configuration management and vulnerability scanners.

How to Mitigate CVE-2026-59848

Immediate Actions Required

Apply the vendor-provided libssh update referenced in RHSA-2026:42922 as soon as it is available for your distribution.
Restart applications and services that link against libssh after patching so the fixed library is loaded.
Restrict outbound SFTP connections to a known allow-list of trusted servers where feasible.

Patch Information

Red Hat has published erratum RHSA-2026:42922 addressing the flaw. Additional context is available in the Red Hat Bug Report #2498181 and the Red Hat CVE-2026-59848 Details page. Users of other distributions should track their vendor's libssh package updates.

Workarounds

Avoid connecting SFTP clients to untrusted or unverified servers until patches are applied.
Enforce strict host key verification to reduce exposure to man-in-the-middle SFTP servers.
Apply per-process memory limits using systemd unit MemoryMax or ulimit -v to bound the impact of unbounded queue growth.

bash

# Example systemd resource limit for an SFTP client service
[Service]
MemoryMax=512M
MemoryHigh=384M