CVE-2026-3731: 
NixOS vulnerability analysis and mitigation

CVE-2026-3731 is an out-of-bounds read vulnerability in libssh's SFTP Extension Name Handler that allows remote attackers to trigger a denial of service without authentication. The flaw affects libssh versions up to and including 0.11.3, specifically in the sftp_extensions_get_name and sftp_extensions_get_data functions within src/sftp.c. It was published on March 8, 2026, with patches released in versions 0.11.4 and 0.12.0. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 6.9 (Medium) (Feedly, Red Hat).

The root cause is improper bounds checking (CWE-125: Out-of-bounds Read; CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer) in the SFTP extension handler. By manipulating the idx argument passed to sftp_extensions_get_name or sftp_extensions_get_data in src/sftp.c, a remote attacker can cause the library to read memory outside the bounds of an allocated buffer. No authentication, special privileges, or user interaction are required for exploitation, as the vulnerable code path is reachable via network-accessible SFTP sessions. The fix is documented in commit 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60 in the libssh mirror repository (GitLab Commit, Feedly).

Successful exploitation can cause application crashes or denial of service conditions in any system or service relying on a vulnerable version of libssh (up to 0.11.3) for SFTP functionality. The primary impact is on availability (rated High in CVSS v3.1), with no direct confidentiality or integrity impact identified. Downstream products incorporating libssh — including Microsoft Azure Linux packages (azl3_libssh) and distributions such as Ubuntu, SUSE, and Amazon Linux 2023 — are also affected (Feedly, Red Hat, Microsoft MSRC).

There is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the time of reporting (Feedly). The EPSS score is approximately 0.047%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

The primary remediation is to upgrade libssh to version 0.11.4 or 0.12.0, both of which include the fix introduced in commit 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60 (GitLab Commit, libssh Release). Linux distribution users should apply vendor-specific security updates: Ubuntu, SUSE (SUSE-SU-2026:0936-1, SUSE-SU-2026:1310-1), openSUSE, and Amazon Linux 2023 (ALAS2023-2026-1759) have all issued advisories. If immediate patching is not feasible, restrict network access to SFTP services running vulnerable libssh versions to reduce remote exploitation exposure (Red Hat, Feedly).

Red Hat, Microsoft (Azure Linux), Ubuntu, SUSE, openSUSE, Amazon Linux, and Splunk have all issued advisories or security updates addressing this vulnerability, reflecting broad downstream impact across major Linux ecosystems (Red Hat, Microsoft MSRC). Coverage has appeared on Linux security news aggregators and German-language security outlets (pro-linux.de), and the vulnerability was noted on Bluesky by CVE tracking accounts. Community sentiment treats this as a routine, low-urgency patch given the absence of public exploits and the limited impact scope.