libssh 0.12.1 and 0.11.5 fix stack overflow and nine other flaws
Security releases address an SFTP server buffer overflow, GSSAPI and ProxyCommand leaks, an AES-GCM integrity downgrade, and multiple denial-of-service bugs.
libssh has issued versions 0.12.1 and 0.11.5 to close ten security flaws, including a stack buffer overflow in the SFTP server and an integrity weakness in AES-GCM handling.
libssh is a widely used C library that implements SSHv2 for clients and servers. The most severe fix, CVE-2026-15370, corrects a stack buffer overflow when the SFTP server builds longname strings, which could let a crafted client corrupt memory on the host.
CVE-2026-59842 covers an information disclosure when a short GSSAPI Curve25519 public key is accepted. CVE-2026-59846 similarly leaks data through ProxyCommand username expansion with %r. CVE-2026-59847 is an integrity downgrade: OpenSSL AES-GCM tag verification could be bypassed, weakening message authentication.
The remaining advisories are denial-of-service issues. CVE-2026-59843 triggers on a zero advertised channel packet size. CVE-2026-59844 accepts an oversized SFTP read length. CVE-2026-59845 fails to handle a ProxyCommand fork failure. CVE-2026-59848 mishandles SFTP responses with unknown request IDs. CVE-2026-59849 can loop during automatic certificate authentication.
The project credited researchers who reported the issues responsibly and urged users to upgrade. Both the current 0.12 line and the older 0.11 branch received parallel fixes.