Red Hat Enterprise Linux 8/9/10/Hardened Images SFTP Server longname stack-based overflow

Summaryinfo

A vulnerability has been found in Red Hat Enterprise Linux 8/9/10/Hardened Images and classified as very critical. Affected by this vulnerability is an unknown functionality of the component SFTP Server. The manipulation of the argument longname leads to stack-based overflow. This vulnerability is documented as CVE-2026-15370. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in Red Hat Enterprise Linux 8/9/10/Hardened Images and classified as very critical. This issue affects an unknown part of the component SFTP Server. The manipulation of the argument longname with an unknown input leads to a stack-based overflow vulnerability. Using CWE to declare the problem leads to CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list attacker-controlled filenames, sufficiently long names can overflow that stack buffer and may lead to crashes or possible code execution on the server.

It is possible to read the advisory at access.redhat.com. The identification of this vulnerability is CVE-2026-15370 since 07/10/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 07/21/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-46169). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Red Hat

Name

• Enterprise Linux

Version

• 8
• 9
• 10
• Hardened Images

License

• commercial

Website

• Vendor: https://www.redhat.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion