CVE-2010-4755: The (1) remote_glob function in sftp-glob.c and the (2) process_put function in sftp.c in OpenSSH 5.8 and e...

Security readout for executives and security teams

CVE-2010-4755 is a denial-of-service issue in OpenSSH SFTP handling. An authenticated remote user could submit crafted glob patterns that consume excessive CPU and memory. The sources identify OpenSSH 5.8 and earlier and cite several BSD uses. It affects availability, not data theft or direct system takeover. Most relevant exposure is legacy OpenSSH SFTP service, especially environments allowing shell or SFTP access to untrusted authenticated users. Internet exposure matters less than who can authenticate. Modern OpenSSH versions are not shown affected by the provided sources. Handle during legacy infrastructure remediation, with faster action for shared SFTP services or systems with many external users. This is primarily an availability risk and does not justify emergency treatment without affected legacy versions or untrusted authenticated access. Mitigation focus: Identify systems running OpenSSH 5.8 or earlier with SFTP enabled.; Prioritize upgrades using vendor OpenSSH or operating-system security guidance.; Restrict SFTP access to trusted authenticated users where upgrades are delayed..

Prepared

Jun 24, 2026, 13:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.