← All notices | Source (USN-8699-1) | Text version

QSN-8699-1: libssh vulnerabilities

August 31, 2026

Summary

Several security issues were fixed in libssh.

Details

It was discovered that libssh had a stack buffer overflow in its SFTP server when constructing directory listing entries for long filenames. An attacker could possibly use this issue to cause libssh to crash or execute arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-15370)

It was discovered that libssh did not correctly handle SSH channel open messages advertising a zero maximum packet size. An authenticated remote attacker could possibly use this issue to cause libssh to consume excessive CPU resources, leading to a denial of service. (CVE-2026-59843)

It was discovered that libssh did not correctly limit SFTP read request lengths in its server implementation. An authenticated remote attacker could possibly use this issue to cause libssh to allocate excessive memory, leading to a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-59844)

It was discovered that libssh did not correctly handle ProxyCommand fork() failures. A local attacker could possibly use this issue to cause a denial of service. (CVE-2026-59845)

It was discovered that libssh did not correctly sanitize shell metacharacters when expanding usernames in ProxyCommand strings. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-59846)

It was discovered that libssh had incorrect AES-GCM tag verification when built with the OpenSSL backend. A machine-in-the-middle attacker could possibly use this issue to modify encrypted traffic without detection. (CVE-2026-59847)

It was discovered that libssh did not correctly handle SFTP server responses for unknown request IDs. An attacker could possibly use this issue to cause libssh to use excessive memory, leading to a denial of service. (CVE-2026-59848)

It was discovered that libssh had logic errors in certificate-based authentication that could cause clients to loop indefinitely when certificates were rejected. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-59849)

It was discovered that libssh could invoke data callbacks on channels after they had been closed. An attacker could possibly use this issue to cause libssh to crash or execute arbitrary code. (CVE-2026-59850)

Affected QuantaStor releases

ReleasePlatformPackageExposureShipped versionFixed versionStatus
6.9.1.001Ubuntu 22.04 LTSlibssh-4Externally-facing0.9.6-2ubuntu0.22.04.80.9.6-2ubuntu0.22.04.8Fixed in this release
6.9.0.464Ubuntu 22.04 LTSlibssh-4Externally-facing0.9.6-2ubuntu0.22.04.80.9.6-2ubuntu0.22.04.8Fixed in this release
6.8.6.015Ubuntu 22.04 LTSlibssh-4Externally-facing0.9.6-2ubuntu0.22.04.80.9.6-2ubuntu0.22.04.8Fixed in this release
6.8.5.018Ubuntu 22.04 LTSlibssh-4Externally-facing0.9.6-2ubuntu0.22.04.70.9.6-2ubuntu0.22.04.8Fixed by QuantaStor security update
6.8.4.038Ubuntu 22.04 LTSlibssh-4Externally-facing0.9.6-2ubuntu0.22.04.70.9.6-2ubuntu0.22.04.8Fixed by QuantaStor security update
6.8.3.018Ubuntu 22.04 LTSlibssh-4Externally-facing0.9.6-2ubuntu0.22.04.70.9.6-2ubuntu0.22.04.8Fixed by QuantaStor security update
6.8.2.002Ubuntu 22.04 LTSlibssh-4Externally-facing0.9.6-2ubuntu0.22.04.70.9.6-2ubuntu0.22.04.8Fixed by QuantaStor security update
6.8.1.007Ubuntu 22.04 LTSlibssh-4Externally-facing0.9.6-2ubuntu0.22.04.70.9.6-2ubuntu0.22.04.8Fixed by QuantaStor security update
6.8.0.205Ubuntu 22.04 LTSlibssh-4Externally-facing0.9.6-2ubuntu0.22.04.70.9.6-2ubuntu0.22.04.8Fixed by QuantaStor security update

Internally-facing: only accessible when logged into the QuantaStor console/ssh as the qadmin administrative sudo user; generally lower priority. Externally-facing: part of a service the storage platform presents on the network (or the kernel), so potentially reachable over the network.

CVEs

CVE-2026-59846, CVE-2026-59847, CVE-2026-59845, CVE-2026-59844, CVE-2026-59848, CVE-2026-15370, CVE-2026-59849, CVE-2026-59850, CVE-2026-59843

References

https://ubuntu.com/security/notices/USN-8699-1

https://nvd.nist.gov/vuln/detail/CVE-2026-59846

https://nvd.nist.gov/vuln/detail/CVE-2026-59847

https://nvd.nist.gov/vuln/detail/CVE-2026-59845

https://nvd.nist.gov/vuln/detail/CVE-2026-59844

https://nvd.nist.gov/vuln/detail/CVE-2026-59848

https://nvd.nist.gov/vuln/detail/CVE-2026-15370

https://nvd.nist.gov/vuln/detail/CVE-2026-59849

https://nvd.nist.gov/vuln/detail/CVE-2026-59850

https://nvd.nist.gov/vuln/detail/CVE-2026-59843

Update

Fixes marked Fixed by QuantaStor security update are applied by upgrading QuantaStor with security patches included (Upgrade Manager). Fixed package versions:

PlatformPackageVersion
Ubuntu 22.04 LTSlibssh0.9.6-2ubuntu0.22.04.8
Ubuntu 24.04 LTSlibssh0.10.6-2ubuntu0.5
resolutelibssh0.11.3-1ubuntu2.1