===========================================================
== Subject:     SFTP client memory exhaustion by sending unexpected responses
==
== CVE ID#:     CVE-2026-59848
==
== Versions:    libssh < 0.12.1; < 0.11.5
==
== Summary:     A malicious SFTP server can exhaust client memory
==              by sending responses with an unknown request ID
==
== Component:   client only
===========================================================

===========
Description
===========

SFTP clients implemented via libssh store incoming responses
in a queue until they are handled. If a response with an unknown
request ID would arrive from a server, libssh would store
it indefinitely. A malicious SFTP server could thus
deplete the memory of a client by repeatedly sending such
response packets. 

==================
Patch Availability
==================

Patches addressing the issues have been posted to:
https://www.libssh.org/security/
Additionally, libssh 0.12.1 and 0.11.5 have been issued
as security releases to correct the defect.  SSH administrators are
advised to upgrade to these releases or apply the patch as soon
as possible.

==================
CVSSv3 calculation
==================
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L (3.7)

==========
Workaround
==========

Do not connect to untrusted SFTP servers.

=======
Credits
=======

Reported by Aisle Research in partnership with Red Hat,
patch provided by Pavol Zacik of the libssh team.

==========================================================
== The libssh team
==========================================================