CVE-2026-0968 Libssh: libssh: denial of service due to malformed sftp message
A malicious SFTP server can cause a denial of service in libssh clients by sending a malformed message that triggers a null dereference.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-0968?
CVE-2026-0968 is a low-severity vulnerability in Redhat Enterprise Linux, published on 26 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an `SSH_FXP_NAME` message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can cause unexpected behavior or lead to a denial of service (DoS) due to application crashes.
Weakness: CWE-476
Which versions are affected by CVE-2026-0968?
It affects 2 products.
Products include Libssh Libssh, Redhat Enterprise Linux.
How do I fix CVE-2026-0968?
Apply the vendor's patch.
Is CVE-2026-0968 being exploited?
There is no known exploitation of CVE-2026-0968 in the wild and no public exploit code.
Other vulnerabilities in Redhat Enterprise Linux
- CVE-2026-59851 Libssh: libssh: authentication bypass via missing gssapi principal check
- CVE-2025-5987 Libssh: invalid return code for chacha20 poly1305 with openssl backend
- CVE-2025-14821 Libssh: libssh: insecure default configuration leads to local man-in-the-middle attacks on windows
- CVE-2012-4560 Memory corruption in n/a
- CVE-2012-4562 Integer overflow in n/a
Sources
Also known as AZL-81849, BELL-CVE-2026-0968, CLSA-2026-1776178207, CLSA-2026-1776181240, CLSA-2026-1776262694, CLSA-2026-1776361748 and 10 more.