https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-59849.htmlhttps://patchthecve.com/cve/CVE-2026-59849.htmlTue, 22 Sep 2026 19:48:05 +0000LOW 3.1: A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when configured certificates are missing or repeatedly rejected by a server, leading to denial of service.https://patchthecve.com/cve/CVE-2026-59842.htmlhttps://patchthecve.com/cve/CVE-2026-59842.htmlTue, 22 Sep 2026 19:47:55 +0000LOW 3.7: A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length is copied without proper length validation, leading to an out-of-bounds heap read. This could allow a remote unauthenticated attacker to disclose small amountshttps://patchthecve.com/cve/CVE-2026-15370.htmlhttps://patchthecve.com/cve/CVE-2026-15370.htmlTue, 22 Sep 2026 19:47:33 +0000MEDIUM 6.7: A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list attacker-controlled filenames, sufficiently long names can overflow that stack buffer and may lead to