Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an `SSH_FXP_NAME` message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can cause unexpected behavior or lead to a denial of service (DoS) due to application crashes.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 2 products
CVE-2026-0968 A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an `SSH_FXP_NAM… https://www.cve.org/CVERecord?id=CVE-2026-0968
Post summary
CVE-2026-0968 reveals a flaw in libssh allowing a malicious SFTP server to send a malformed 'longname' field within a SSH_FXP_NAM packet, potentially leading to exploitation.
3 of 3 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | libssh | libssh | - | - | - |
| OS | redhat | enterprise_linux | 10.0 | - | - |
| OS | redhat | enterprise_linux | 9.0 | - | - |