A flaw in the libssh library allows a remote authenticated user to issue SSH_FXP_READ requests with a synthetic large length. The library allocates memory proportional to the requested size, which can exhaust system memory when the requests are repeated. This symptom is a denial of service without leaking confidential data or executing arbitrary code. The weakness corresponds to CWE‑789: unchecked input leading to unsafe allocation.

Systems that ship the vulnerable libssh implementation are affected. This includes Red Hat Enterprise Linux 10, 7, 8, 9 and Red Hat Hardened Images. The exact libssh package and version are not disclosed, but any instance of the library built for those operating systems is potentially vulnerable.

The CVSS score of 6.5 reflects a moderate severity. The EPSS score of less than 1 % indicates a very low likelihood of exploitation in the wild and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a valid SSH session, which limits the attack surface to authenticated users. An attacker who can establish or gain access to an SFTP session can send repeated oversized read requests, forcing the server to consume large amounts of memory and potentially trigger a crash or a service failure.