CVE-2026-3731

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3731", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-03-07T17:52:02.964Z", "datePublished": "2026-03-08T10:32:19.482Z", "dateUpdated": "2026-03-11T19:50:33.441Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-08T10:32:19.482Z"}, "title": "libssh SFTP Extension Name sftp.c sftp_extensions_get_data out-of-bounds", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-125", "lang": "en", "description": "Out-of-Bounds Read"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-119", "lang": "en", "description": "Memory Corruption"}]}], "affected": [{"vendor": "n/a", "product": "libssh", "versions": [{"version": "0.11.0", "status": "affected"}, {"version": "0.11.1", "status": "affected"}, {"version": "0.11.2", "status": "affected"}, {"version": "0.11.3", "status": "affected"}, {"version": "0.11.4", "status": "unaffected"}, {"version": "0.12.0", "status": "unaffected"}], "cpes": ["cpe:2.3:a:libssh:libssh:*:*:*:*:*:*:*:*"], "modules": ["SFTP Extension Name Handler"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:ND/RL:OF/RC:C"}}], "timeline": [{"time": "2026-03-07T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-03-07T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-03-07T19:00:46.000Z", "lang": "en", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.349709", "name": "VDB-349709 | libssh SFTP Extension Name sftp.c sftp_extensions_get_data out-of-bounds", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.349709", "name": "VDB-349709 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.767120", "name": "Submit #767120 | libssh.org libssh libssh < 0.11.4; < 0.12.0 Out-of-Bounds Read", "tags": ["third-party-advisory"]}, {"url": "https://www.libssh.org/security/advisories/libssh-2026-sftp-extensions.txt", "tags": ["related"]}, {"url": "https://gitlab.com/libssh/libssh-mirror/-/commit/855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60", "tags": ["patch"]}, {"url": "https://www.libssh.org/files/0.12/libssh-0.12.0.tar.xz", "tags": ["patch"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-11T19:50:26.998747Z", "id": "CVE-2026-3731", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T19:50:33.441Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3731", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-11T19:50:26.998747Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T19:50:30.436Z"}}], "cna": {"title": "libssh SFTP Extension Name sftp.c sftp_extensions_get_data out-of-bounds", "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:ND/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:libssh:libssh:*:*:*:*:*:*:*:*"], "vendor": "n/a", "modules": ["SFTP Extension Name Handler"], "product": "libssh", "versions": [{"status": "affected", "version": "0.11.0"}, {"status": "affected", "version": "0.11.1"}, {"status": "affected", "version": "0.11.2"}, {"status": "affected", "version": "0.11.3"}, {"status": "unaffected", "version": "0.11.4"}, {"status": "unaffected", "version": "0.12.0"}]}], "timeline": [{"lang": "en", "time": "2026-03-07T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-03-07T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-03-07T19:00:46.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.349709", "name": "VDB-349709 | libssh SFTP Extension Name sftp.c sftp_extensions_get_data out-of-bounds", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.349709", "name": "VDB-349709 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.767120", "name": "Submit #767120 | libssh.org libssh libssh < 0.11.4; < 0.12.0 Out-of-Bounds Read", "tags": ["third-party-advisory"]}, {"url": "https://www.libssh.org/security/advisories/libssh-2026-sftp-extensions.txt", "tags": ["related"]}, {"url": "https://gitlab.com/libssh/libssh-mirror/-/commit/855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60", "tags": ["patch"]}, {"url": "https://www.libssh.org/files/0.12/libssh-0.12.0.tar.xz", "tags": ["patch"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "Out-of-Bounds Read"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-119", "description": "Memory Corruption"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-08T10:32:19.482Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3731", "state": "PUBLISHED", "dateUpdated": "2026-03-11T19:50:33.441Z", "dateReserved": "2026-03-07T17:52:02.964Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-03-08T10:32:19.482Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:libssh:libssh:*:*:*:*:*:*:*:*"], "modules": ["SFTP Extension Name Handler"], "product": "libssh", "vendor": "n/a", "versions": [{"status": "affected", "version": "0.11.0"}, {"status": "affected", "version": "0.11.1"}, {"status": "affected", "version": "0.11.2"}, {"status": "affected", "version": "0.11.3"}, {"status": "unaffected", "version": "0.11.4"}, {"status": "unaffected", "version": "0.12.0"}]}], "source": "cna@vuldb.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:libssh:libssh:*:*:*:*:*:*:*:*", "matchCriteriaId": "2366D711-FD0B-4A04-92BA-DE6DA0ED1BCF", "versionEndIncluding": "0.11.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component."}, {"lang": "es", "value": "Se ha identificado una debilidad en libssh hasta la versi\u00f3n 0.11.3. El elemento afectado es la funci\u00f3n sftp_extensions_get_name/sftp_extensions_get_data del archivo src/sftp.c del componente Gestor de Nombres de Extensi\u00f3n SFTP. La ejecuci\u00f3n de una manipulaci\u00f3n del argumento idx puede llevar a una lectura fuera de l\u00edmites. El ataque puede realizarse de forma remota. La actualizaci\u00f3n a las versiones 0.11.4 y 0.12.0 es suficiente para resolver este problema. Este parche se denomina 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. Debe actualizar el componente afectado."}], "id": "CVE-2026-3731", "lastModified": "2026-06-17T10:44:05.853", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3731", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-11T19:50:26.998747Z", "version": "2.0.3"}}]}, "published": "2026-03-08T11:15:50.307", "references": [{"source": "cna@vuldb.com", "tags": ["Patch"], "url": "https://gitlab.com/libssh/libssh-mirror/-/commit/855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required", "VDB Entry"], "url": "https://vuldb.com/?ctiid.349709"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?id.349709"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?submit.767120"}, {"source": "cna@vuldb.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://www.libssh.org/files/0.12/libssh-0.12.0.tar.xz"}, {"source": "cna@vuldb.com", "tags": ["Product"], "url": "https://www.libssh.org/security/advisories/libssh-2026-sftp-extensions.txt"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}, {"lang": "en", "value": "CWE-125"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{"bugzilla": {"description": "libssh: libssh: Denial of Service via out-of-bounds read in SFTP extension name handler", "id": "2445579", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445579"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in libssh. A remote attacker could trigger an out-of-bounds read vulnerability in the SFTP Extension Name Handler by manipulating the `idx` argument in the `sftp_extensions_get_name` or `sftp_extensions_get_data` functions. This could lead to a Denial of Service (DoS), making the affected system unresponsive."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-3731", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "libssh", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Fix deferred", "package_name": "libssh2", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "libssh2", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "libssh", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "libssh", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-03-08T10:32:19Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-3731\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-3731\nhttps://gitlab.com/libssh/libssh-mirror/-/commit/855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60\nhttps://vuldb.com/?ctiid.349709\nhttps://vuldb.com/?id.349709\nhttps://vuldb.com/?submit.767120\nhttps://www.libssh.org/files/0.12/libssh-0.12.0.tar.xz\nhttps://www.libssh.org/security/advisories/libssh-2026-sftp-extensions.txt"], "statement": "A MODERATE impact out-of-bounds read vulnerability exists in libssh's SFTP extension. A remote attacker could exploit this flaw by manipulating an argument to the `sftp_extensions_get_name/sftp_extensions_get_data` functions, potentially leading to a denial of service or information disclosure. This affects Red Hat Enterprise Linux versions utilizing libssh.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.11.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.11.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.11.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.11.3"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "0.11.4"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "0.12.0"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "libssh", "source": "cna", "vendor": "n/a"}, "product": "libssh", "vendor": "libssh"}], "analysis": {"en": {"generated_at": "2026-04-16T04:20:56.529809+00:00", "value": {"mitigation_remediation": ["Upgrade libssh to the fixed releases 0.11.4 or 0.12.0", "Restart all services that link against libssh to ensure the updated library is in use", "If an upgrade is temporarily infeasible, block or disable the SFTP protocol for external clients to prevent the vulnerable function from being exercised"], "summary": {"action": "Patch", "impact": "Out-of-bounds read enabling remote information disclosure"}, "threat_synthesis": {"affected_systems": "All installations of libssh up to and including version 0.11.3 are affected. Versions 0.11.4 and 0.12.0 include the fixed commit 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. The library is used by a variety of applications that provide SFTP services, so any deployment that employs the vulnerable libssh library is at risk.", "description_and_impact": "This vulnerability resides in the SFTP Extension Name Handler of libssh, specifically in the functions sftp_extensions_get_name and sftp_extensions_get_data. It allows an attacker to cause an out-of-bounds read by manipulating the index argument, potentially leaking arbitrary memory contents. The issue is not a code\u2011execution flaw but can expose sensitive data stored in the process\u2019s memory, such as credentials or encryption keys, thereby compromising confidentiality.", "risk_and_exploitability": "The CVSS v3.1 score of 6.9 signifies a moderate severity, and the EPSS score of <1% indicates a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attack requires remote access to the SFTP service and the ability to send crafted requests that trigger the out-of-bounds read. If an attacker achieves successful exploitation, they could read arbitrary data from the server\u2019s memory, leading to information disclosure. Because the flaw is in an out-of-bounds read rather than a remote code\u2011execution vector, immediate exploitation is unlikely, but the impact on confidentiality should still be mitigated. "}}}}, "created": "2026-03-09T10:03:16.837933+00:00", "updated": "2026-04-16T04:30:13.949516+00:00", "vendors": ["libssh", "libssh$PRODUCT$libssh"]}