CVE-2026-3731

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-3731
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-3731.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-3731
Downstream
Related
Published
2026-03-08T10:32:19.482Z
Modified
2026-05-29T07:51:35.578317Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X CVSS Calculator
Summary
libssh SFTP Extension Name sftp.c sftp_extensions_get_data out-of-bounds
Details

A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftpextensionsgetname/sftpextensionsgetdata of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3731.json",
    "cwe_ids": [
        "CWE-119",
        "CWE-125"
    ],
    "cna_assigner": "VulDB"
}
References

Affected packages

Git / gitlab.com/libssh/libssh-mirror

Affected ranges

Type
GIT
Repo
https://gitlab.com/libssh/libssh-mirror
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60

Affected versions

libssh-0.*
libssh-0.11.0
libssh-0.8.0
Other
release-0-3-0

Database specific

vanir_signatures_modified 
"2026-05-29T07:51:35Z"
vanir_signatures 
[
    {
        "target": {
            "file": "src/sftp.c",
            "function": "sftp_extensions_get_data"
        },
        "id": "CVE-2026-3731-254bef34",
        "signature_type": "Function",
        "digest": {
            "function_hash": "24448468969138265884785329107942446000",
            "length": 341.0
        },
        "signature_version": "v1",
        "source": "https://gitlab.com/libssh/libssh-mirror@855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60",
        "deprecated": false
    },
    {
        "target": {
            "file": "src/sftp.c",
            "function": "sftp_extensions_get_name"
        },
        "id": "CVE-2026-3731-6aeb4341",
        "signature_type": "Function",
        "digest": {
            "function_hash": "202487601221476550103335908013974753101",
            "length": 341.0
        },
        "signature_version": "v1",
        "source": "https://gitlab.com/libssh/libssh-mirror@855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60",
        "deprecated": false
    },
    {
        "target": {
            "file": "src/sftp.c"
        },
        "id": "CVE-2026-3731-844a70da",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "45869386280972937582204502160812282977",
                "75140046862169441082434852326701470484",
                "151682577421623218729386355289173953547",
                "295959248680867526462238789964720241899",
                "45869386280972937582204502160812282977",
                "75140046862169441082434852326701470484",
                "151682577421623218729386355289173953547",
                "295959248680867526462238789964720241899"
            ]
        },
        "signature_version": "v1",
        "source": "https://gitlab.com/libssh/libssh-mirror@855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60",
        "deprecated": false
    }
]
source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-3731.json"