CVE-2026-15370
Publication date 21 July 2026
Last updated 25 August 2026
Ubuntu priority
Description
A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list attacker-controlled filenames, sufficiently long names can overflow that stack buffer and may lead to crashes or possible code execution on the server.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| libssh | 26.04 LTS resolute |
Vulnerable
|
| 24.04 LTS noble |
Not affected
|
|
| 22.04 LTS jammy |
Not affected
|
|
| 20.04 LTS focal |
Not affected
|
|
| 18.04 LTS bionic |
Not affected
|
|
| 16.04 LTS xenial |
Not affected
|
Notes
mdeslaur
introduced in libssh 0.11.0 with the following: https://github.com/libssh/libssh-mirror/commit/5ea54c8159f923b53070ecaf6329330ed60c07dc previously, the code was present in the examples directory only which is not shipped in Ubuntu packaging.
Severity score breakdown
CVSS version: CVSS v3.0
Base score
6.7 · Medium
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H