CVE-2026-0968: 
NixOS vulnerability analysis and mitigation

CVE-2026-0968 is a NULL pointer dereference vulnerability in libssh affecting its SFTP client implementation. A malicious SFTP server can exploit this flaw by sending a malformed longname field within an SSH_FXP_NAME message during a file listing operation; the missing NULL check causes libssh to read beyond allocated heap memory, potentially resulting in application crashes or unexpected behavior. All libssh versions up to and including 0.11.3 are affected, as are Red Hat Enterprise Linux 9 and 10 systems shipping vulnerable libssh packages. The vulnerability was reported on February 4, 2026, publicly disclosed on February 10, 2026, and has a CVSS v3.1 base score of 3.1 (Low) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-476 (NULL Pointer Dereference): libssh fails to validate that the longname field in an SSH_FXP_NAME SFTP protocol message is properly null-terminated before processing it during directory listing operations. When a client connects to a malicious SFTP server and performs a file listing (e.g., sftp_readdir()), the server can return a crafted response with a malformed longname field, causing the library to read beyond the bounds of the allocated heap buffer. Exploitation requires user interaction — specifically, a user must connect to and interact with a malicious SFTP server — and attack complexity is rated High, as the attacker must control or impersonate an SFTP server the victim connects to (Red Hat CVE, libssh Security Release).

Successful exploitation results in a limited availability impact: the libssh client application may crash or exhibit undefined behavior due to an out-of-bounds heap read. There is no confidentiality or integrity impact, as the vulnerability does not enable code execution or data exfiltration. The scope is limited to the affected client process, with no evidence of lateral movement potential or privilege escalation (Red Hat CVE, Red Hat Bugzilla).

No public proof-of-concept exploit code or in-the-wild exploitation has been observed for CVE-2026-0968. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.029% (0.000290), reflecting a very low probability of exploitation in the near term. The high attack complexity and requirement for user interaction (connecting to a malicious SFTP server) significantly limit practical exploitability (Red Hat CVE).

1. Set up a malicious SFTP server: The attacker configures a rogue SFTP server (e.g., using a custom implementation or modified open-source server) capable of sending crafted SSH_FXP_NAME responses with a malformed or missing null-terminator in the longname field.
2. Lure the victim: The attacker tricks a user running a libssh-based SFTP client (version ≤ 0.11.3) into connecting to the malicious server, for example via phishing, DNS spoofing, or a man-in-the-middle attack on an unverified SSH host key.
3. Trigger directory listing: Once connected, the attacker waits for or induces the client to perform a directory listing operation (e.g., ls in an SFTP session), which causes the client to send an SSH_FXP_READDIR request.
4. Send malformed response: The malicious server responds with an SSH_FXP_NAME message containing a longname field that lacks proper null-termination or is otherwise malformed.
5. Trigger crash: libssh processes the malformed longname without a NULL check, reads beyond the allocated heap buffer, and the client application crashes (DoS) (Red Hat Bugzilla, libssh Security Release).

• Logs: Application crash logs or core dumps from processes using libssh during SFTP directory listing operations; error messages referencing SFTP or SSH_FXP_NAME parsing failures.
• Process: Unexpected termination (segmentation fault or abort signal) of applications linking against libssh when performing SFTP file listing against an untrusted server.
• Network: SFTP connections to unknown or unexpected server IP addresses, particularly if followed immediately by client process crashes; anomalous SSH_FXP_NAME responses with unusually large or malformed longname fields captured in packet traces.

Upgrade libssh to version 0.11.4 or 0.12.0, which include the fix for this vulnerability (libssh Security Release). Red Hat Enterprise Linux 10 users should apply the update provided in RHSA-2026:18160 (libssh-0.12.0-2.el10), and RHEL 9 users should apply RHSA-2026:18683 (libssh-0.10.4-18.el9) (RHSA-2026:18160, RHSA-2026:18683). As a workaround where patching is not immediately possible, restrict SFTP client connections to trusted, verified servers only and enforce strict SSH host key verification to reduce exposure to malicious servers.

The libssh project released security advisories alongside versions 0.11.4 and 0.12.0 on February 10, 2026, addressing this and several other CVEs (libssh Security Release). Red Hat issued Moderate-severity advisories for RHEL 9 and 10 in May 2026. Downstream distributions including Ubuntu, SUSE, Slackware, Fedora, Amazon Linux 2023, and AlmaLinux also issued updates. Community and media reaction has been minimal given the low CVSS score and limited impact, with no notable researcher commentary or significant social media discussion observed.