Detections
Analytics

Echo: libssh: security update to 0.12.0-1

medium Tenable Cloud Security Plugin ID 457226

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - A weakness has been identified in libssh up to 0.11.3. The impacted element is the function
 sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension
 Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may
 be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This
 patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component.
 (CVE-2026-3731)

Solution

Update the libssh library and its related packages to version 0.12.0-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-3731

Plugin Details

Severity: Medium

ID: 457226

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.93

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2026-3731

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.9

Threat Score: 2.7

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/19/2026

Vulnerability Publication Date: 2/19/2026

Reference Information

CVE: CVE-2026-3731

IAVA: 2026-A-0166-S