Medium severity4.2NVD Advisory· Published Jul 8, 2026· Updated Jul 9, 2026
CVE-2026-59997
CVE-2026-59997
Description
internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection.
Affected products
6- osv-coords2 versionspkg:rpm/opensuse/openssh&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/openssh-askpass-gnome&distro=openSUSE%20Leap%2016.0
< 10.0p2-160000.7.1+ 1 more
- (no CPE)range: < 10.0p2-160000.7.1
- (no CPE)range: < 10.0p2-160000.7.1
Patches
Vulnerability mechanics
References
3- marc.infonvdRelease Notes
- www.openssh.org/releasenotes.htmlnvdRelease Notes
- www.openwall.com/lists/oss-security/2026/07/06/5nvdMailing ListRelease Notes
News mentions
1- OpenSSH 10.4 Patches Six Vulnerabilities in Authentication and File Transfer ComponentsVypr Intelligence · Jul 8, 2026