Pavol Žáčik 9563afc950 CVE-2026-59848 sftp: handle responses with unknown request IDs ...

This adds a new field to sftp_session_struct,
containing a list of outstanding request IDs.
An ID is added to the list when a request
is constructed and removed when the corresponding
request is received. If a client receives a response
with an unknown request ID, it reports an error.

Storing responses with unknown request IDs in
the response queue could be abused by a malicious
SFTP server which could deplete client memory
this way.

Signed-off-by: Pavol Žáčik <pzacik@redhat.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
(cherry picked from commit 26147eb476)

2026-07-16 11:51:04 +02:00

..

libssh

CVE-2026-59848 sftp: handle responses with unknown request IDs

2026-07-16 11:51:04 +02:00

CMakeLists.txt

cmake: Do not use CMAKE_(SOURCE|BINARY)_DIR

2015-06-24 18:17:05 +02:00