libssh-0.11.5 * Security: * CVE-2026-15370: Stack buffer overflow in SFTP server longname construction * CVE-2026-59843: Denial of service via zero advertised channel packet size * CVE-2026-59844: Denial of service via oversized SFTP read length * CVE-2026-59845: Denial of service via unchecked ProxyCommand fork() failure * CVE-2026-59846: Information disclosure via ProxyCommand %r username expansion * CVE-2026-59847: Integrity downgrade via OpenSSL AES-GCM tag verification * CVE-2026-59848: Denial of service via SFTP responses with unknown request IDs * CVE-2026-59849: Denial of service via automatic certificate authentication loop * CVE-2026-59850: Use-after-free via data callbacks on closed channels * Zero-initialize every ssh_string * Compatibility: * Fix compatibility with C23 / gcc16 * Bugfixes: * Fix multiple memory leaks, null checks, and error checks * Validate peer public key in DH key exchange * Avoid remote window overflow * Avoid off-by-one overflow during kbdint authentication * Avoid logging uninitialized sequence numbers * Avoid double conversion of SFTP version number * Send correct SFTP server version number * Avoid handling repeated SFTP INIT messages * Harmonize return values from SFTP server callbacks