CVE-2026-59848 in libssh
Summary
by MITRE • 07/21/2026
A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/21/2026
This vulnerability exists within the libssh library implementation where a malicious sftp server can exploit a protocol handling flaw by sending responses for unknown request ids that the client maintains in an indefinite queue. The technical mechanism involves the client's request tracking system failing to properly validate incoming response identifiers against its active request queue, allowing rogue responses to accumulate without proper cleanup or timeout mechanisms. This design flaw directly relates to CWE-129 and CWE-400 as it represents improper input validation combined with resource management issues that can lead to unbounded memory consumption.
The operational impact of this vulnerability manifests as a progressive memory exhaustion attack that can render the affected client application completely unresponsive or crash entirely. When a malicious sftp server sends these unauthorized responses, each one gets added to the client's internal request tracking structure without proper bounds checking, leading to continuous memory allocation until system resources are exhausted. This creates a denial of service condition that affects any application using libssh for sftp client functionality, potentially disrupting critical infrastructure operations and data transfer processes.
From a threat modeling perspective, this vulnerability aligns with ATT&CK technique T1499.004 which covers network denial of service attacks through resource exhaustion. The attack vector requires a malicious sftp server to be present in the network path or for the client to connect to an compromised sftp server, making it particularly dangerous in environments where sftp connectivity is required for legitimate business operations. Security practitioners should note that this issue affects not just standalone applications but also integrated systems that rely on libssh for secure file transfer capabilities.
The recommended mitigations include implementing proper bounds checking on request identifiers within the client library, establishing timeout mechanisms for queued requests, and ensuring that unknown response types are properly discarded rather than accumulated. Organizations should prioritize updating their libssh implementations to versions that address this specific queue management flaw while also implementing network segmentation controls to limit exposure to potentially malicious sftp servers. Additionally, monitoring systems should be configured to detect unusual memory usage patterns in sftp client processes as early warning indicators of potential exploitation attempts.