CVE catalog

CVE-2026-66033

libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2_cipher_crypt() function in src/openssl.c that allows a malicious SSH server t

[CVE catalog]

Severity
High · CVSS 8.7
Published
Source
[NVD] · [CVE record]
EPSS
0.58% · Oct 25, 2026

libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2_cipher_crypt() function in src/openssl.c that allows a malicious SSH server to crash any connecting client by negotiating AES-GCM ciphers during handshake. Attackers can exploit the underflow in the expression computing blocksize minus aadlen minus authentication tag length to trigger an out-of-bounds read and a memcpy call with a near-SIZE_MAX length argument, causing immediate process crash before any authentication occurs.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibssh2sid1.11.1-6fixed
Debianlibssh2forky1.11.1-6fixed
Debianlibssh2trixie1.11.1-1+deb13u2fixed
Debianlibssh2trixie-security1.11.1-1+deb13u1vulnerable
Debianlibssh2bookworm1.10.0-3not affected
Debianlibssh2bookworm-security1.10.0-3+deb12u1not affected
Ubuntulibssh2noble1.11.0-4.1ubuntu0.24.04.4fixed
Ubuntulibssh2-1-devnoble1.11.0-4.1ubuntu0.24.04.4fixed
Ubuntulibssh2-1t64noble1.11.0-4.1ubuntu0.24.04.4fixed
Ubuntulibssh224.041.11.0-2vulnerable
Ubuntulibssh224.041.11.0-3vulnerable
Ubuntulibssh224.041.11.0-4vulnerable
Ubuntulibssh224.041.11.0-4.1build1vulnerable
Ubuntulibssh224.041.11.0-4.1build2vulnerable
Ubuntulibssh224.041.11.0-4.1ubuntu0.24.04.1vulnerable
Ubuntulibssh224.041.11.0-4.1ubuntu0.24.04.2vulnerable
Ubuntulibssh224.041.11.0-4.1ubuntu0.24.04.3vulnerable
Ubuntulibssh224.041.11.0-4.1ubuntu0.24.04.4fixed
Ubuntulibssh226.041.11.1-1build1vulnerable
Ubuntulibssh226.041.11.1-1build2vulnerable
Ubuntulibssh226.041.11.1-1ubuntu0.26.04.1vulnerable
Ubuntulibssh226.041.11.1-1ubuntu0.26.04.2vulnerable
Ubuntulibssh226.041.11.1-1ubuntu0.26.04.3vulnerable
Ubuntulibssh226.041.11.1-1ubuntu0.26.04.4fixed
Alpinelibssh23.211.11.1-r3fixed
Alpinelibssh23.221.11.1-r3fixed
Alpinelibssh23.231.11.1-r4fixed
Alpinelibssh23.241.11.1-r4fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibssh2sourcesid1.11.1-5not yet assignedNot reported[1142856]
Debianlibssh2sourceforky1.11.1-5not yet assignedNot reported[1142856]
Debianlibssh2sourcetrixie1.11.1-1+deb13u2not yet assignedNot reported[1142856]
Debianlibssh2sourcebookwormNot affectedunimportantNot reported[1142856]
Ubuntulibssh2debnoble1.11.0-4.1ubuntu0.24.04.4Not reportedNot reportedNot reported
Ubuntulibssh2-1-devdebnoble1.11.0-4.1ubuntu0.24.04.4Not reportedNot reportedNot reported
Ubuntulibssh2-1t64debnoble1.11.0-4.1ubuntu0.24.04.4Not reportedNot reportedNot reported
Ubuntulibssh2deb24.041.11.0-4.1ubuntu0.24.04.4Not reportedUBUNTU-CVE-2026-66033Not reported
Ubuntulibssh2deb26.041.11.1-1ubuntu0.26.04.4Not reportedUBUNTU-CVE-2026-66033Not reported
Alpinelibssh2apk3.211.11.1-r3Not reportedALPINE-CVE-2026-66033Not reported
Alpinelibssh2apk3.221.11.1-r3Not reportedALPINE-CVE-2026-66033Not reported
Alpinelibssh2apk3.231.11.1-r4Not reportedALPINE-CVE-2026-66033Not reported
Alpinelibssh2apk3.241.11.1-r4Not reportedALPINE-CVE-2026-66033Not reported

[Debian bug #1142856]

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [libssh2-1-dev]Affected

    Source package: [libssh2]

    Details (4)

    • 1.11.1-1+deb13u1 · amd64 · trixie

      Affected · Fixed: 1.11.1-1+deb13u2

      nvd · libssh2 · debian · 13

    • 1.11.1-1+deb13u1 · arm64 · trixie

      Affected · Fixed: 1.11.1-1+deb13u2

      nvd · libssh2 · debian · 13

    • 1.11.1-1+deb13u1 · amd64 · trixie-security

      Affected · Fixed: 1.11.1-1+deb13u2

      nvd · libssh2 · debian · 13

    • 1.11.1-1+deb13u1 · arm64 · trixie-security

      Affected · Fixed: 1.11.1-1+deb13u2

      nvd · libssh2 · debian · 13

  • [libssh2-1t64]Affected

    Source package: [libssh2]

    Details (4)

    • 1.11.1-1+deb13u1 · amd64 · trixie

      Affected · Fixed: 1.11.1-1+deb13u2

      nvd · libssh2 · debian · 13

    • 1.11.1-1+deb13u1 · arm64 · trixie

      Affected · Fixed: 1.11.1-1+deb13u2

      nvd · libssh2 · debian · 13

    • 1.11.1-1+deb13u1 · amd64 · trixie-security

      Affected · Fixed: 1.11.1-1+deb13u2

      nvd · libssh2 · debian · 13

    • 1.11.1-1+deb13u1 · arm64 · trixie-security

      Affected · Fixed: 1.11.1-1+deb13u2

      nvd · libssh2 · debian · 13

[Debian 12 (Bookworm)]

  • [libssh2-1]Not affected

    Source package: [libssh2]

    Details (2)

    • 1.10.0-3+b1 · amd64 · bookworm

      Not affected

      nvd · libssh2 · debian · bookworm

    • 1.10.0-3+b1 · arm64 · bookworm

      Not affected

      nvd · libssh2 · debian · bookworm

  • [libssh2-1-dev]Not affected

    Source package: [libssh2]

    Details (2)

    • 1.10.0-3+b1 · amd64 · bookworm

      Not affected

      nvd · libssh2 · debian · bookworm

    • 1.10.0-3+b1 · arm64 · bookworm

      Not affected

      nvd · libssh2 · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]