CVE-2026-15370 — Libssh: libssh: stack buffer overflow in sftp server longname construction
A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client cause…
Published: 2026-07-21 · CVSS: 6.7 · CVSS 3.1
A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list attacker-controlled filenames, sufficiently long names can overflow that stack buffer and may lead to crashes or possible code execution on the server.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7