CVE-2026-0968 on CTRL-OS 24.05
Packages: libssh
Status: Plausible
CVE Information
A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an
SSH_FXP_NAMEmessage during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can cause unexpected behavior or lead to a denial of service (DoS) due to application crashes.
Updates
2026-04-07 17:44 CEST
Metadata changes:
- Status for package
libssh: “Plausible”