UBUNTU-CVE-2026-59997

Details

internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection.

Affected Packages

openssh-ssh1

Ubuntu 18.04 LTS

Affected versions:

1:7.5p1-101:7.5p1-81:7.5p1-91:7.5p1-9build1

openssh-ssh1

Ubuntu 20.04 LTS

Affected versions:

1:7.5p1-11build1

openssh

Ubuntu 22.04 LTS

Fixed in:

1:8.9p1-3ubuntu0.16

openssh-ssh1

Ubuntu 22.04 LTS

Affected versions:

1:7.5p1-121:7.5p1-12build11:7.5p1-13

openssh

Ubuntu 24.04 LTS

Fixed in:

1:9.6p1-3ubuntu13.18

openssh-ssh1

Ubuntu 24.04 LTS

Affected versions:

1:7.5p1-141:7.5p1-151:7.5p1-15build11:7.5p1-16

openssh

Ubuntu 25.10

Affected versions:

1:10.0p1-5ubuntu21:10.0p1-5ubuntu31:10.0p1-5ubuntu41:10.0p1-5ubuntu51:10.0p1-5ubuntu5.11:10.0p1-5ubuntu5.41:9.9p1-3ubuntu31:9.9p1-3ubuntu3.1

openssh-ssh1

Ubuntu 25.10

Affected versions:

1:7.5p1-17

openssh

Ubuntu 26.04 LTS

Fixed in:

1:10.2p1-2ubuntu3.4

openssh-ssh1

Ubuntu 26.04 LTS

Affected versions:

1:7.5p1-171:7.5p1-18

References

REPORT

https://ubuntu.com/security/CVE-2026-59997

ADVISORY

https://ubuntu.com/security/notices/USN-8533-1

REPORT

https://www.cve.org/CVERecord?id=CVE-2026-59997

REPORT

https://www.openssh.org/releasenotes.html#10.4p1