[CLSA-2026:1791837443] libssh: Fix of CVE-2026-59844
Type:
security
Severity:
Moderate
Release date:
2026-10-12 20:37:33 UTC
Description:
- CVE-2026-59844: cap the client-supplied SSH_FXP_READ length in sftp_get_client_message() at MAX_PACKET_LEN - 1024 so an SFTP server built on libssh is not driven into unbounded allocations
CVEs fixed:
Updated packages:
  • libssh-0.10.4-15.el9_6.tuxcare.els11.aarch64.rpm
    sha:73c092c6d030c79abd17805883ee519bda39c455884eda3e0ab39c931a637402
  • libssh-0.10.4-15.el9_6.tuxcare.els11.i686.rpm
    sha:27b76c23212565a9b3dfc5f3374ad4e9de3aed5fa21056d359f6653ffddf3711
  • libssh-0.10.4-15.el9_6.tuxcare.els11.x86_64.rpm
    sha:bb8431fbd4242e852fd6ee311a71c5211b1f0f7658d733bd44c4a63c97b3b792
  • libssh-config-0.10.4-15.el9_6.tuxcare.els11.noarch.rpm
    sha:dbe01a541b277bb2fca7e890754bfc87ff8f88abad46509efd9ae07edad0ef60
  • libssh-devel-0.10.4-15.el9_6.tuxcare.els11.aarch64.rpm
    sha:89ec3423123c1f91aa9f9e1424ee0eac291efd2c97805d54c048bd9efff65798
  • libssh-devel-0.10.4-15.el9_6.tuxcare.els11.i686.rpm
    sha:98636fac9c277403c22586b4ca762ea17e14d0b41ffc8a9bf02553b10f165e54
  • libssh-devel-0.10.4-15.el9_6.tuxcare.els11.x86_64.rpm
    sha:2d1c8c363f070d66bdd8d448014c08ac55f9813f4645cd1b453f65111bfdb881
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.