Vulnerability Details CVE-2026-59848
A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 23.2%
CVSS Severity
CVSS v3 Score 5.3
References
Products affected by CVE-2026-59848
-
cpe:2.3:a:libssh:libssh:-
-
cpe:2.3:a:redhat:hardened_images:-
-
cpe:2.3:o:redhat:enterprise_linux:10.0
-
cpe:2.3:o:redhat:enterprise_linux:8.0
-
cpe:2.3:o:redhat:enterprise_linux:9.0