CVE-2026-59997 Details
Description
internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection.
A vulnerability exists in the internal-sftp component of OpenSSH's sshd service, prior to version 10.4, where only the first nine command-line arguments are recognized. This limitation can lead to unintended security implications for SFTP connections, as any security-relevant options placed in the tenth argument or later are ignored.
Users can upgrade to OpenSSH version 10.4 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://marc.info/?l=openssh-unix-dev&m=178333966933090&w=2 | [email protected] | Release Notes |
| https://www.openssh.org/releasenotes.html#10.4p1 | [email protected] | Release Notes |
| https://www.openwall.com/lists/oss-security/2026/07/06/5 | [email protected] | Mailing ListRelease Notes |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1284 | Improper Validation of Specified Quantity in Input | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openbsd openssh | < 10.4 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 9, 2026 | Initial Analysis | [email protected] |
| Jul 8, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | [email protected] |