SUSE-SU-2026:22940-1

This update for libssh fixes the following issues:

• CVE-2026-15370: stack buffer overflow in SFTP server longname construction (bsc#1272162).
• CVE-2026-59843: denial of service via zero advertised channel packet size (bsc#1272164).
• CVE-2026-59844: denial of service via oversized SFTP read length (bsc#1272165).
• CVE-2026-59845: denial of service via unchecked ProxyCommand fork() failure (bsc#1272166).
• CVE-2026-59846: information disclosure via ProxyCommand %r username expansion (bsc#1272167).
• CVE-2026-59847: integrity downgrade via OpenSSL AES-GCM tag verification (bsc#1272168).
• CVE-2026-59848: denial of service via SFTP responses with unknown request IDs (bsc#1272169).
• CVE-2026-59849: denial of service via automatic certificate authentication loop (bsc#1272170).
• CVE-2026-59850: use-after-free via data callbacks on closed channels (bsc#1272171).

Changes for libssh:

• Update to 0.11.5:

• Zero-initialize every ssh_string
• Fix compatibility with C23 / gcc16
• Fix multiple memory leaks, null checks, and error checks
• Validate peer public key in DH key exchange
• Avoid remote window overflow
• Avoid off-by-one overflow during kbdint authentication
• Avoid logging uninitialized sequence numbers
• Avoid double conversion of SFTP version number
• Send correct SFTP server version number
• Avoid handling repeated SFTP INIT messages
• Harmonize return values from SFTP server callbacks

• Update %suse_version checks for SLES 16.x (jsc#PED-15815)