libssh 0.12.1 and 0.11.5 security releases

[Alan Coopersmith <alan.coopersmith () oracle com>]

https://www.libssh.org/2026/07/21/libssh-0-12-1-and-0-11-5-security-releases/
announces:
> Within the storm of AI-assisted reports, we are pleased to announce another
> libssh releases, bringing mostly security relevant fixes for both new
> features and code that was used for years.
>
> A big thank you to all the security researchers who responsibly reported the
> issues to us, as well as to all the contributors who made this release
> possible!
>
> For those new to libssh, we recommend checking out our getting started
> tutorial. If you have any questions, feel free to join our mailing list or
> visit our Matrix channel.
>
> You can download libssh-0.12.1 here: https://www.libssh.org/files/0.12/
> and libssh-0.11.5 in here: https://www.libssh.org/files/0.11/
>
> ChangeLog for libssh 0.12.1:
>
>   Security:
>
>     CVE-2026-15370: Stack buffer overflow in SFTP server longname construction
>         http://www.libssh.org/security/advisories/CVE-2026-15370.txt
>     CVE-2026-59842: Information disclosure via short GSSAPI Curve25519 public key
>         http://www.libssh.org/security/advisories/CVE-2026-59842.txt
>     CVE-2026-59843: Denial of service via zero advertised channel packet size
>         http://www.libssh.org/security/advisories/CVE-2026-59843.txt
>     CVE-2026-59844: Denial of service via oversized SFTP read length
>         http://www.libssh.org/security/advisories/CVE-2026-59844.txt
>     CVE-2026-59845: Denial of service via unchecked ProxyCommand fork() failure
>         http://www.libssh.org/security/advisories/CVE-2026-59845.txt
>     CVE-2026-59846: Information disclosure via ProxyCommand %r username expansion
>         http://www.libssh.org/security/advisories/CVE-2026-59846.txt
>     CVE-2026-59847: Integrity downgrade via OpenSSL AES-GCM tag verification
>         http://www.libssh.org/security/advisories/CVE-2026-59847.txt
>     CVE-2026-59848: Denial of service via SFTP responses with unknown request IDs
>         http://www.libssh.org/security/advisories/CVE-2026-59848.txt
>     CVE-2026-59849: Denial of service via automatic certificate authentication loop
>         http://www.libssh.org/security/advisories/CVE-2026-59849.txt
>     CVE-2026-59850: Use-after-free via data callbacks on closed channels
>         http://www.libssh.org/security/advisories/CVE-2026-59850.txt
>     CVE-2026-59851: Authentication bypass via missing GSSAPI principal check
>         http://www.libssh.org/security/advisories/CVE-2026-59851.txt
>     Zero-initialize every ssh_string
>
>   Compatibility:
>
>     Fix compatibility with C23 / gcc16
>     Allow hybrid ML-KEM key exchange in FIPS mode
>
>   Bugfixes:
>
>     Fix multiple memory leaks, null checks, and error checks
>     Fix parameter size mismatch in mlkem768x25519-sha256
>     Fix client SFTP messages being ignored if sent at high rate
>     Validate peer public key in DH key exchange
>     Fix ambiguous error reporting of sftp_init
>     Fix hidden integer underflow in socket packet callback
>     Avoid remote window overflow
>     Fix socket data callback return value on rekey failure
>     Avoid off-by-one overflow during kbdint authentication
>     Avoid logging uninitialized sequence numbers
>     Avoid double conversion of SFTP version number
>     Send correct SFTP server version number
>     Avoid handling repeated SFTP INIT messages
>     Harmonize return values from SFTP server callbacks
>
> ChangeLog for libssh 0.11.5:
>
>   Security:
>
>     CVE-2026-15370: Stack buffer overflow in SFTP server longname construction
>         http://www.libssh.org/security/advisories/CVE-2026-15370.txt
>     CVE-2026-59843: Denial of service via zero advertised channel packet size
>         http://www.libssh.org/security/advisories/CVE-2026-59843.txt
>     CVE-2026-59844: Denial of service via oversized SFTP read length
>         http://www.libssh.org/security/advisories/CVE-2026-59844.txt
>     CVE-2026-59845: Denial of service via unchecked ProxyCommand fork() failure
>         http://www.libssh.org/security/advisories/CVE-2026-59845.txt
>     CVE-2026-59846: Information disclosure via ProxyCommand %r username expansion
>         http://www.libssh.org/security/advisories/CVE-2026-59846.txt
>     CVE-2026-59847: Integrity downgrade via OpenSSL AES-GCM tag verification
>         http://www.libssh.org/security/advisories/CVE-2026-59847.txt
>     CVE-2026-59848: Denial of service via SFTP responses with unknown request IDs
>         http://www.libssh.org/security/advisories/CVE-2026-59848.txt
>     CVE-2026-59849: Denial of service via automatic certificate authentication loop
>         http://www.libssh.org/security/advisories/CVE-2026-59849.txt
>     CVE-2026-59850: Use-after-free via data callbacks on closed channels
>         http://www.libssh.org/security/advisories/CVE-2026-59850.txt
>     Zero-initialize every ssh_string
>
>   Compatibility:
>
>     Fix compatibility with C23 / gcc16
>
>   Bugfixes:
>
>     Fix multiple memory leaks, null checks, and error checks
>     Validate peer public key in DH key exchange
>     Avoid remote window overflow
>     Avoid off-by-one overflow during kbdint authentication
>     Avoid logging uninitialized sequence numbers
>     Avoid double conversion of SFTP version number
>     Send correct SFTP server version number
>     Avoid handling repeated SFTP INIT messages
>     Harmonize return values from SFTP server callbacks