===========================================================
== Subject:     DoS by unbounded SFTP client-controlled malloc
==
== CVE ID#:     CVE-2026-59844
==
== Versions:    libssh < 0.12.1; < 0.11.5
==
== Summary:     Requesting SFTP file reads of up to 4 GiB leads
==              to large memory allocations in libssh SFTP servers
==
===========================================================

===========
Description
===========

A remote, authenticated attacker can send an SSH_FXP_READ
request to a libssh SFTP server and set the read length
(in bytes) to an arbitrary 32-bit unsigned integer.
The server does not perform any checks on this value and
allocates the corresponding memory (up to 4 GiB). 

The memory is freed immediately following the read, but
the attacker can sustain the attack by sending large
read requests repeatedly and simultaneously over multiple
SFTP channels. This can exhaust memory capabilities of
the server, potentially causing DoS for other users.

==================
Patch Availability
==================

Patches addressing the issues have been posted to:
https://www.libssh.org/security/
Additionally, libssh 0.12.1 and 0.11.5 have been issued
as security releases to correct the defect.  SSH administrators are
advised to upgrade to these releases or apply the patch as soon
as possible.

==================
CVSSv3 calculation
==================
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (6.5)

==========
Workaround
==========

No workaround available.

=======
Credits
=======

Originally reported by Chanho Kim and patch provided
by Pavol Zacik of the libssh team.

==========================================================
== The libssh team
==========================================================