The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1344-1 advisory.

    - CVE-2026-3731: denial of service via out-of-bounds read in SFTP extension name handler (bsc#1259377).
    - CVE-2026-0964: SCP protocol path traversal in `ssh_scp_pull_request()` (bsc#1258049).
    - CVE-2026-0965: possible denial of service when parsing unexpected configuration files (bsc#1258045).
    - CVE-2026-0966: buffer underflow in `ssh_get_hexa()` on invalid input (bsc#1258054).
    - CVE-2026-0967: specially crafted patterns could cause a denial of service (bsc#1258081).
    - CVE-2026-0968: out-of-bounds read in `sftp_parse_longname()` (bsc#1258080).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:18160 advisory.

    * libssh: Buffer underflow in ssh_get_hexa() on invalid input (CVE-2026-0966)

    * libssh: Improper sanitation of paths received from SCP servers (CVE-2026-0964)

    * libssh: libssh: Denial of Service via improper configuration file handling (CVE-2026-0965)

    * libssh: libssh: Denial of Service via inefficient regular expression processing (CVE-2026-0967)

    * libssh: libssh: Denial of Service due to malformed SFTP message (CVE-2026-0968)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1776701249 advisory.

  - A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this     by sending a malformed 'longname' field within an `SSH_FXP_NAME` message during a file listing operation.
    This missing null check can lead to reading beyond allocated memory on the heap. This can cause unexpected     behavior or lead to a denial of service (DoS) due to application crashes. (CVE-2026-0968)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4844 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4844-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Simon Quigley     October 20, 2026                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : libssh     Version        : 0.10.6-0+deb12u3     CVE ID         : CVE-2026-0964 CVE-2026-0965 CVE-2026-0966 CVE-2026-0967                      CVE-2026-0968 CVE-2026-3731 CVE-2026-59843 CVE-2026-59844                      CVE-2026-59845 CVE-2026-59846 CVE-2026-59847 CVE-2026-59848                      CVE-2026-59850

    Several vulnerabilities were discovered in libssh, a tiny C SSH library.

    CVE-2026-0964

        A malicious SCP server can send a path that escapes the working         directory. This is the same issue as OpenSSH CVE-2019-6111.

    CVE-2026-0965

        Parsing a configuration file that is not a regular file, or that is         too large, could be used for a denial of service.

    CVE-2026-0966

        ssh_get_hexa() could underflow a heap buffer on invalid input.

    CVE-2026-0967

        A crafted pattern in a configuration or known_hosts file could make         match_pattern() backtrack until it times out.

    CVE-2026-0968

        A malicious SFTP server can send a longname that         sftp_parse_longname() reads past.

    CVE-2026-3731

        sftp_extensions_get_name() and sftp_extensions_get_data() did not         reject an index past the end of the extension list.

    CVE-2026-59843

        A peer that advertises a maximum channel packet size of 0 can cause         a denial of service.

    CVE-2026-59844

        An oversized length in an SSH_FXP_READ request can cause a denial of         service.

    CVE-2026-59845

        ProxyCommand did not check the return value of fork(), which can         cause a denial of service.

    CVE-2026-59846

        A username containing shell metacharacters could be expanded into         ProxyCommand via %r.

    CVE-2026-59847

        With the OpenSSL backend, a failed AES-GCM tag check could be         treated as success. The gcrypt backend was already correct.

    CVE-2026-59848

        An SFTP response with a request id the client did not send could         cause a denial of service.

    CVE-2026-59850

        A DATA packet on a remotely closed channel could be delivered to a         callback after the channel was freed.

    For Debian 12 bookworm, these problems have been fixed in version     0.10.6-0+deb12u3.

    We recommend that you upgrade your libssh packages.

    For the detailed security status of libssh please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libssh

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
306680	SUSE SLES12 Security Update : libssh (SUSE-SU-2026:1344-1)	Nessus	SuSE Local Security Checks	2026/4/16	2026/5/6	medium
318292	RockyLinux 10 : libssh (RLSA-2026:18160)	Nessus	Rocky Linux Local Security Checks	2026/6/3	2026/6/3	high
361614	CentOS Linux 8.4 [TuxCare] Security Update: libssh / libssh-config / libssh-devel (CENTOS8.4:CLSA-2026:1776701249)	Nessus	CentOS Local Security Checks	2026/10/1	2026/10/1	low
372635	Debian dla-4844 : libssh-4 - security update	Nessus	Debian Local Security Checks	2026/10/27	2026/10/28	medium

检测

插件搜索

medium

high

low

medium