{"id":"CLSA-2026-1791823540","summary":"Fix CVE(s): CVE-2025-15661, CVE-2026-7598","details":"   * SECURITY UPDATE: out-of-bounds heap read in SFTP symlink handling\n     - debian/patches/CVE-2025-15661.patch: validate that the link length\n       in a SSH_FXP_NAME response fits within the received packet before\n       copying it in sftp_symlink() in src/sftp.c\n     - CVE-2025-15661","modified":"2026-10-26T09:32:05.636747957Z","published":"2026-10-19T15:58:53Z","upstream":["CVE-2025-15661","CVE-2026-7598"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1791823540.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15661"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7598"}],"affected":[{"package":{"name":"libssh2-1","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/libssh2-1?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-2.1ubuntu0.1+tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1791823540.json"}},{"package":{"name":"libssh2-1-dev","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/libssh2-1-dev?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-2.1ubuntu0.1+tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1791823540.json"}}],"schema_version":"1.9.0"}