CVE-2026-15370 in Red Hat
Summary
by MITRE • 07/21/2026
A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list attacker-controlled filenames, sufficiently long names can overflow that stack buffer and may lead to crashes or possible code execution on the server.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/21/2026
This vulnerability exists within the libssh library's implementation of Secure File Transfer Protocol operations, specifically during directory listing functionality on SFTP servers. The flaw manifests as an insufficient bounds checking mechanism in the construction of the longname field that is used to represent file metadata during directory enumeration. The vulnerability stems from the use of unsafe string concatenation operations that directly append user-supplied filenames into a fixed-size stack buffer without proper validation of the total buffer capacity.
The technical implementation involves the server constructing a formatted string representation of directory entries where each file's name is concatenated into a predetermined buffer size. When an attacker controls the filenames being listed and provides sufficiently long strings, the cumulative concatenation exceeds the allocated stack buffer space, resulting in a classic stack buffer overflow condition. This vulnerability operates at the protocol level within the SFTP server implementation and represents a direct violation of secure coding practices that should prevent such buffer overflows.
The operational impact of this vulnerability extends beyond simple service disruption to potentially enable remote code execution on affected servers. When the stack buffer overflow occurs, it can corrupt adjacent memory locations including return addresses and control structures, leading to unpredictable program behavior that attackers can potentially exploit to execute arbitrary code with the privileges of the running sshd process. The vulnerability affects any system running libssh versions where SFTP server functionality is enabled and actively used by clients.
Mitigation strategies should focus on immediate patching of affected libssh implementations to address the buffer overflow condition through proper bounds checking and safe string handling mechanisms. Organizations should also implement network segmentation and access controls to limit exposure of SFTP services to trusted networks only, while monitoring for suspicious directory listing patterns that might indicate exploitation attempts. The vulnerability aligns with CWE-121 Stack-based Buffer Overflow and can be mapped to ATT&CK technique T1059 Command and Scripting Interpreter as it enables remote command execution capabilities when successfully exploited. Additionally, implementing proper input validation and using memory-safe programming practices such as those recommended in the CERT C Secure Coding Standard would prevent similar issues in future implementations.