Most recent entries from all

BELL-CVE-2026-66035

Affected: Alpaquita:23: libssh2, Alpaquita:25: libssh2, Alpaquita:stream: libssh2

BREW-libssh2-CVE-2026-66035 — libssh2 Heap Buffer Overflow via ETM Cipher Negotiation

Affected: Homebrew: libssh2

libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packet_length smaller than the cipher's block size during Encrypt-then-MAC cipher negotiation. In the fullpacket() function in src/transport.c, the ETM path allocates a buffer of packet_length bytes but copies blocksize minus one bytes via memcpy, causing an overflow that on 32-bit glibc writes attacker-controlled bytes into an adjacent chunk's SIZE field, enabling tcache bin confusion, overlapping live objects, and function pointer overwrite during the session handshake before authentication.

fkie_cve-2026-66035

GHSA-v6rf-8q4r-r495

msrc_CVE-2026-66035 — libssh2 Heap Buffer Overflow via ETM Cipher Negotiation

msrc_CVE-2026-66035

OESA-2026-3392 — libssh2 security update

Affected: openEuler:24.03-LTS-SP3: libssh2

libssh2 is a library implementing the SSH2 protocol as defined by Internet Drafts: SECSH-TRANS(22), SECSH-USERAUTH(25), SECSH-CONNECTION(23), SECSH-ARCH(20), SECSH-FILEXFER(06)*, SECSH-DHGEX(04), and SECSH-NUMBERS(10). Security Fix(es):

libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation num_attrs * sizeof(libssh2_publickey_attribute) without bounds checking, so on 32-bit platforms the multiplication overflows to an undersized buffer. A malicious SSH server can then drive the attribute-parsing loop to write past the allocation, causing a heap buffer overflow in a connecting libssh2 client.(CVE-2026-58050)

libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSH_FXP_OPEN with SSH_FXP_STATUS containing FX_OK, the response data buffer is freed, and if a subsequent sftp_packet_require() call returns a specific error such as LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED, the same pointer is freed a second time, enabling tcache dup conditions on glibc systems that allow overlapping allocations and function pointer overwrites.(CVE-2026-66032)

libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2_cipher_crypt() function in s…

openSUSE-SU-2026:11454-1 — libssh2-1-1.11.1-4.1 on GA media

libssh2-1-1.11.1-4.1 on GA media

RHSA-2026:46955 — Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

libssh2: libssh2: Arbitrary code execution via heap buffer overflow during SSH negotiation

SUSE-SU-2026:23049-1 — Security update for libssh2_org

Security update for libssh2_org

UBUNTU-CVE-2026-66035

Affected: Ubuntu:Pro:14.04:LTS: libssh2, Ubuntu:Pro:16.04:LTS: libssh2, Ubuntu:Pro:18.04:LTS: libssh2, Ubuntu:Pro:20.04:LTS: libssh2, Ubuntu:22.04:LTS: libssh2, Ubuntu:24.04:LTS: libssh2, Ubuntu:26.04:LTS: libssh2

WID-SEC-W-2026-2516 — libssh2: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in libssh2 ausnutzen, um möglicherweise vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuführen oder beliebigen Code auszuführen.