p PatchFirst

CVE-2026-59997

CVE-2026-59997

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection.

CVSS 4.2 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: system · network

Affected products and versions

  • openssh

    Versions
    • ≥ 0, < 10.4: Affected (custom)

    Update to 10.4

  • openssh Debian:12

    Versions
    • 1:10.0p1-1
    • 1:10.0p1-2
    • 1:10.0p1-3
    • 1:10.0p1-4
    • 1:10.0p1-5
    • 1:10.0p1-5~bpo12+2
    • 1:10.0p1-6
    • 1:10.0p1-7
    • 1:10.0p1-7~bpo12+1
    • 1:10.0p1-8
    • 1:10.1p1-1
    • 1:10.1p1-2
    • 1:10.2p1-1
    • 1:10.2p1-2
    • 1:10.2p1-2~bpo13+1
    • 1:10.2p1-3
    • 1:10.2p1-4
    • 1:10.2p1-5
    • 1:10.2p1-6
    • 1:10.2p1-6~bpo13+1
    • 1:10.3p1-1
    • 1:10.3p1-1~bpo13+1
    • 1:10.3p1-2
    • 1:10.3p1-3
    • 1:10.3p1-4
    • 1:10.3p1-5
    • 1:10.3p1-7
    • 1:10.3p1-8
    • 1:10.3p1-9
    • 1:10.4p1-1
    • 1:10.4p1-2
    • 1:10.4p1-3
    • 1:10.4p1-4
    • 1:10.4p1-5
    • 1:10.5p1-1
    • 1:9.2p1-2
    • 1:9.2p1-2+deb12u1
    • 1:9.2p1-2+deb12u10
    • 1:9.2p1-2+deb12u2
    • 1:9.2p1-2+deb12u3
    • 1:9.2p1-2+deb12u4
    • 1:9.2p1-2+deb12u5
    • 1:9.2p1-2+deb12u6
    • 1:9.2p1-2+deb12u7
    • 1:9.2p1-2+deb12u8
    • 1:9.2p1-2+deb12u9
    • 1:9.3p1-1
    • 1:9.3p1-1+loong64
    • 1:9.3p2-1
    • 1:9.4p1-1
    • 1:9.5p1-1
    • 1:9.5p1-2
    • 1:9.6p1-1
    • 1:9.6p1-2
    • 1:9.6p1-3
    • 1:9.6p1-4
    • 1:9.6p1-5
    • 1:9.7p1-1
    • 1:9.7p1-2
    • 1:9.7p1-3
    • 1:9.7p1-3+hurd.1
    • 1:9.7p1-4
    • 1:9.7p1-5
    • 1:9.7p1-6
    • 1:9.7p1-7
    • 1:9.8p1-1
    • 1:9.8p1-2
    • 1:9.8p1-3
    • 1:9.8p1-4
    • 1:9.8p1-7
    • 1:9.8p1-8
    • 1:9.9p1-1
    • 1:9.9p1-2
    • 1:9.9p1-3
    • 1:9.9p1-3+hurd.1
    • 1:9.9p2-1
    • 1:9.9p2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openssh Debian:13

    Versions
    • 1:10.0p1-7
    • 1:10.0p1-7+deb13u1
    • 1:10.0p1-7+deb13u2
    • 1:10.0p1-7+deb13u3
    • 1:10.0p1-7+deb13u4
    • 1:10.0p1-8
    • 1:10.1p1-1
    • 1:10.1p1-2
    • 1:10.2p1-1
    • 1:10.2p1-2
    • 1:10.2p1-2~bpo13+1
    • 1:10.2p1-3
    • 1:10.2p1-4
    • 1:10.2p1-5
    • 1:10.2p1-6
    • 1:10.2p1-6~bpo13+1
    • 1:10.3p1-1
    • 1:10.3p1-1~bpo13+1
    • 1:10.3p1-2
    • 1:10.3p1-3
    • 1:10.3p1-4
    • 1:10.3p1-5
    • 1:10.3p1-7
    • 1:10.3p1-8
    • 1:10.3p1-9
    • 1:10.4p1-1
    • 1:10.4p1-2
    • 1:10.4p1-3
    • 1:10.4p1-4
    • 1:10.4p1-5
    • 1:10.5p1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openssh Debian:14

    Versions
    • 1:10.0p1-7
    • 1:10.0p1-8
    • 1:10.1p1-1
    • 1:10.1p1-2
    • 1:10.2p1-1
    • 1:10.2p1-2
    • 1:10.2p1-2~bpo13+1
    • 1:10.2p1-3
    • 1:10.2p1-4
    • 1:10.2p1-5
    • 1:10.2p1-6
    • 1:10.2p1-6~bpo13+1
    • 1:10.3p1-1
    • 1:10.3p1-1~bpo13+1
    • 1:10.3p1-2
    • 1:10.3p1-3
    • 1:10.3p1-4
    • 1:10.3p1-5
    • 1:10.3p1-7
    • 1:10.3p1-8
    • 1:10.3p1-9
    Affected ranges
    • ECOSYSTEM: < 1:10.4p1-1

    Update to 1:10.4p1-1

  • openssh Ubuntu:Pro:14.04:LTS

    Versions
    • 1:6.2p2-6
    • 1:6.2p2-6ubuntu1
    • 1:6.4p1-1
    • 1:6.4p1-2
    • 1:6.5p1-1
    • 1:6.5p1-2
    • 1:6.5p1-3
    • 1:6.5p1-4
    • 1:6.5p1-6
    • 1:6.6p1-1
    • 1:6.6p1-2
    • 1:6.6p1-2ubuntu1
    • 1:6.6p1-2ubuntu2
    • 1:6.6p1-2ubuntu2.2
    • 1:6.6p1-2ubuntu2.3
    • 1:6.6p1-2ubuntu2.4
    • 1:6.6p1-2ubuntu2.6
    • 1:6.6p1-2ubuntu2.7
    • 1:6.6p1-2ubuntu2.8
    • 1:6.6p1-2ubuntu2.10
    • 1:6.6p1-2ubuntu2.11
    • 1:6.6p1-2ubuntu2.12
    • 1:6.6p1-2ubuntu2.13
    • 1:6.6p1-2ubuntu2.13+esm1
    • 1:6.6p1-2ubuntu2.13+esm2
    • 1:6.6p1-2ubuntu2.13+esm3
    Affected ranges
    • ECOSYSTEM: < 1:6.6p1-2ubuntu2.13+esm4

    Update to 1:6.6p1-2ubuntu2.13+esm4

  • openssh Ubuntu:Pro:16.04:LTS

    Versions
    • 1:6.9p1-2
    • 1:6.9p1-3
    • 1:7.1p1-1
    • 1:7.1p1-3
    • 1:7.1p1-4
    • 1:7.1p1-6
    • 1:7.1p2-1
    • 1:7.1p2-2
    • 1:7.2p1-1
    • 1:7.2p2-1
    • 1:7.2p2-2
    • 1:7.2p2-3
    • 1:7.2p2-4
    • 1:7.2p2-4ubuntu1
    • 1:7.2p2-4ubuntu2.1
    • 1:7.2p2-4ubuntu2.2
    • 1:7.2p2-4ubuntu2.4
    • 1:7.2p2-4ubuntu2.5
    • 1:7.2p2-4ubuntu2.6
    • 1:7.2p2-4ubuntu2.7
    • 1:7.2p2-4ubuntu2.8
    • 1:7.2p2-4ubuntu2.10
    • 1:7.2p2-4ubuntu2.10+esm1
    • 1:7.2p2-4ubuntu2.10+esm2
    • 1:7.2p2-4ubuntu2.10+esm3
    • 1:7.2p2-4ubuntu2.10+esm4
    • 1:7.2p2-4ubuntu2.10+esm5
    • 1:7.2p2-4ubuntu2.10+esm6
    • 1:7.2p2-4ubuntu2.10+esm7
    • 1:7.2p2-4ubuntu2.10+esm8
    • 1:7.2p2-4ubuntu2.10+esm9
    Affected ranges
    • ECOSYSTEM: < 1:7.2p2-4ubuntu2.10+esm10

    Update to 1:7.2p2-4ubuntu2.10+esm10

  • openssh Ubuntu:Pro:FIPS-updates:16.04:LTS

    Versions
    • 1:7.2p2-4ubuntu2.fips.2.2.3
    • 1:7.2p2-4ubuntu2.fips.2.4.1
    • 1:7.2p2-4ubuntu2.fips.2.4.2
    • 1:7.2p2-4ubuntu2.fips.2.8.1
    • 1:7.2p2-4ubuntu2.fips.2.10.1
    • 1:7.2p2-4ubuntu2.fips.2.10.2
    • 1:7.2p2-4ubuntu2.fips.2.10.3
    • 1:7.2p2-4ubuntu2.fips.2.10.4
    • 1:7.2p2-4ubuntu2.fips.2.10.5
    • 1:7.2p2-4ubuntu2.fips.2.10.6
    • 1:7.2p2-4ubuntu2.fips.2.10.7
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openssh Ubuntu:Pro:FIPS:16.04:LTS

    Versions
    • 1:7.2p2-4ubuntu2.fips.2.2
    • 1:7.2p2-4ubuntu2.fips.2.2.1
    • 1:7.2p2-4ubuntu2.fips.2.10.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openssh Ubuntu:Pro:18.04:LTS

    Versions
    • 1:7.5p1-10
    • 1:7.6p1-4
    • 1:7.6p1-4ubuntu0.1
    • 1:7.6p1-4ubuntu0.2
    • 1:7.6p1-4ubuntu0.3
    • 1:7.6p1-4ubuntu0.5
    • 1:7.6p1-4ubuntu0.6
    • 1:7.6p1-4ubuntu0.7
    • 1:7.6p1-4ubuntu0.7+esm1
    • 1:7.6p1-4ubuntu0.7+esm2
    • 1:7.6p1-4ubuntu0.7+esm3
    • 1:7.6p1-4ubuntu0.7+esm4
    • 1:7.6p1-4ubuntu0.7+esm5
    Affected ranges
    • ECOSYSTEM: < 1:7.6p1-4ubuntu0.7+esm6

    Update to 1:7.6p1-4ubuntu0.7+esm6

  • openssh-ssh1 Ubuntu:18.04:LTS

    Versions
    • 1:7.5p1-8
    • 1:7.5p1-9
    • 1:7.5p1-9build1
    • 1:7.5p1-10
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openssh Ubuntu:Pro:FIPS-updates:18.04:LTS

    Versions
    • 1:7.9p1-10~ubuntu18.04.fips.0.1
    • 1:7.9p1-10~ubuntu18.04.fips.0.2
    • 1:7.9p1-10~ubuntu18.04.fips.0.3
    • 1:7.9p1-10~ubuntu18.04.fips.0.4
    • 1:7.9p1-10~ubuntu18.04.fips.0.5
    • 1:7.9p1-10~ubuntu18.04.fips.0.6
    • 1:7.9p1-10~ubuntu18.04.fips.0.7
    • 1:7.9p1-10~ubuntu18.04.fips.0.8
    • 1:7.9p1-10~ubuntu18.04.fips.0.9
    • 1:7.9p1-10~ubuntu18.04.fips.0.10
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openssh Ubuntu:Pro:FIPS:18.04:LTS

    Versions
    • 1:7.9p1-10~ubuntu18.04.fips.0.1
    • 1:7.9p1-10~ubuntu18.04.fips.0.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openssh Ubuntu:Pro:20.04:LTS

    Versions
    • 1:8.0p1-6build1
    • 1:8.1p1-1
    • 1:8.1p1-5
    • 1:8.2p1-4
    • 1:8.2p1-4ubuntu0.1
    • 1:8.2p1-4ubuntu0.2
    • 1:8.2p1-4ubuntu0.3
    • 1:8.2p1-4ubuntu0.4
    • 1:8.2p1-4ubuntu0.5
    • 1:8.2p1-4ubuntu0.7
    • 1:8.2p1-4ubuntu0.8
    • 1:8.2p1-4ubuntu0.9
    • 1:8.2p1-4ubuntu0.10
    • 1:8.2p1-4ubuntu0.11
    • 1:8.2p1-4ubuntu0.12
    • 1:8.2p1-4ubuntu0.13
    • 1:8.2p1-4ubuntu0.13+esm1
    • 1:8.2p1-4ubuntu0.13+esm2
    Affected ranges
    • ECOSYSTEM: < 1:8.2p1-4ubuntu0.13+esm3

    Update to 1:8.2p1-4ubuntu0.13+esm3

  • openssh-ssh1 Ubuntu:20.04:LTS

    Versions
    • 1:7.5p1-11build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openssh Ubuntu:Pro:FIPS-updates:20.04:LTS

    Versions
    • 1:8.2p1-4ubuntu0.fips.0.2.1
    • 1:8.2p1-4ubuntu0.fips.0.4.0
    • 1:8.2p1-4ubuntu0.fips.0.5.0
    • 1:8.2p1-4ubuntu0.fips.0.7
    • 1:8.2p1-4ubuntu0.fips.0.8
    • 1:8.2p1-4ubuntu0.fips.0.9
    • 1:8.2p1-4ubuntu0.fips.0.10
    • 1:8.2p1-4ubuntu0.fips.0.11
    • 1:8.2p1-4ubuntu0.fips.0.12
    • 1:8.2p1-4ubuntu0.fips.0.13
    • 1:8.2p1-4ubuntu0.fips.0.13.1
    • 1:8.2p1-4ubuntu0.fips.0.13.3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openssh Ubuntu:Pro:FIPS:20.04:LTS

    Versions
    • 1:8.2p1-4ubuntu0.fips.0.2.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openssh Ubuntu:22.04:LTS

    Versions
    • 1:8.4p1-6ubuntu2
    • 1:8.7p1-2
    • 1:8.7p1-2build1
    • 1:8.7p1-4
    • 1:8.8p1-1
    • 1:8.9p1-3
    • 1:8.9p1-3ubuntu0.1
    • 1:8.9p1-3ubuntu0.3
    • 1:8.9p1-3ubuntu0.4
    • 1:8.9p1-3ubuntu0.5
    • 1:8.9p1-3ubuntu0.6
    • 1:8.9p1-3ubuntu0.7
    • 1:8.9p1-3ubuntu0.10
    • 1:8.9p1-3ubuntu0.11
    • 1:8.9p1-3ubuntu0.13
    • 1:8.9p1-3ubuntu0.14
    • 1:8.9p1-3ubuntu0.15
    Affected ranges
    • ECOSYSTEM: < 1:8.9p1-3ubuntu0.16

    Update to 1:8.9p1-3ubuntu0.16

  • openssh-ssh1 Ubuntu:22.04:LTS

    Versions
    • 1:7.5p1-12
    • 1:7.5p1-12build1
    • 1:7.5p1-13
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openssh Ubuntu:Pro:FIPS-preview:22.04:LTS

    Versions
    • 1:8.9p1-3ubuntu0.4+Fips1
    • 1:8.9p1-3ubuntu0.4+Fips3
    • 1:8.9p1-3ubuntu1.fips.0~ppa3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openssh Ubuntu:Pro:FIPS-updates:22.04:LTS

    Versions
    • 1:8.9p1-3ubuntu0.4+Fips1
    • 1:8.9p1-3ubuntu0.4+Fips3
    • 1:8.9p1-3ubuntu0.6+Fips1
    • 1:8.9p1-3ubuntu0.7+Fips1
    • 1:8.9p1-3ubuntu0.10+Fips1
    • 1:8.9p1-3ubuntu0.11+Fips1
    • 1:8.9p1-3ubuntu0.13+Fips1
    • 1:8.9p1-3ubuntu0.14+Fips1
    • 1:8.9p1-3ubuntu0.15+Fips1
    • 1:8.9p1-3ubuntu0.15+Fips3
    Affected ranges
    • ECOSYSTEM: < 1:8.9p1-3ubuntu0.16+Fips3

    Update to 1:8.9p1-3ubuntu0.16+Fips3

  • openssh Ubuntu:24.04:LTS

    Versions
    • 1:9.3p1-1ubuntu3
    • 1:9.4p1-1ubuntu1
    • 1:9.6p1-3ubuntu1
    • 1:9.6p1-3ubuntu2
    • 1:9.6p1-3ubuntu11
    • 1:9.6p1-3ubuntu12
    • 1:9.6p1-3ubuntu13
    • 1:9.6p1-3ubuntu13.3
    • 1:9.6p1-3ubuntu13.4
    • 1:9.6p1-3ubuntu13.5
    • 1:9.6p1-3ubuntu13.7
    • 1:9.6p1-3ubuntu13.8
    • 1:9.6p1-3ubuntu13.9
    • 1:9.6p1-3ubuntu13.11
    • 1:9.6p1-3ubuntu13.12
    • 1:9.6p1-3ubuntu13.13
    • 1:9.6p1-3ubuntu13.14
    • 1:9.6p1-3ubuntu13.15
    • 1:9.6p1-3ubuntu13.16
    Affected ranges
    • ECOSYSTEM: < 1:9.6p1-3ubuntu13.18

    Update to 1:9.6p1-3ubuntu13.18

  • openssh-ssh1 Ubuntu:24.04:LTS

    Versions
    • 1:7.5p1-14
    • 1:7.5p1-15
    • 1:7.5p1-15build1
    • 1:7.5p1-16
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openssh Ubuntu:Pro:FIPS-updates:24.04:LTS

    Versions
    • 1:9.6p1-3ubuntu13.7+Fips1
    • 1:9.6p1-3ubuntu13.12+Fips1
    • 1:9.6p1-3ubuntu13.13+Fips1
    • 1:9.6p1-3ubuntu13.14+Fips1
    • 1:9.6p1-3ubuntu13.15+Fips1
    • 1:9.6p1-3ubuntu13.16+Fips1
    • 1:9.6p1-3ubuntu13.16+Fips2
    Affected ranges
    • ECOSYSTEM: < 1:9.6p1-3ubuntu13.18+Fips1

    Update to 1:9.6p1-3ubuntu13.18+Fips1

  • openssh Ubuntu:25.10

    Versions
    • 1:9.9p1-3ubuntu3
    • 1:9.9p1-3ubuntu3.1
    • 1:10.0p1-5ubuntu2
    • 1:10.0p1-5ubuntu3
    • 1:10.0p1-5ubuntu4
    • 1:10.0p1-5ubuntu5
    • 1:10.0p1-5ubuntu5.1
    • 1:10.0p1-5ubuntu5.4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →