CVE catalog

CVE-2026-66034

libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of a

[CVE catalog]

Severity
High · CVSS 7.7
Published
Source
[NVD] · [CVE record]
EPSS
0.40% · Oct 25, 2026

libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of an uninitialized pointer via the publickey subsystem. In libssh2_publickey_list_fetch(), the version 1 response parser reads a server-controlled comment_len value and advances the parse pointer without verifying sufficient bytes remain in the buffer, causing the out-of-bounds read to leak heap pointers from adjacent allocations defeating ASLR, followed by heap allocator state corruption when the error cleanup path frees an uninitialized pointer from a non-zeroed realloc() region.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibssh2sid1.11.1-6fixed
Debianlibssh2forky1.11.1-6fixed
Debianlibssh2trixie1.11.1-1+deb13u2fixed
Debianlibssh2trixie-security1.11.1-1+deb13u1vulnerable
Debianlibssh2bookworm1.10.0-3vulnerable
Debianlibssh2bookworm-security1.10.0-3+deb12u1fixed
Ubuntulibssh2pro1.8.0-2.1build1vulnerable
Ubuntulibssh2pro1.8.0-2.1ubuntu0.1vulnerable
Ubuntulibssh2pro1.8.0-2.1ubuntu0.1+esm1fixed
Ubuntulibssh222.041.9.0-3vulnerable
Ubuntulibssh222.041.10.0-2vulnerable
Ubuntulibssh222.041.10.0-2build1vulnerable
Ubuntulibssh222.041.10.0-3vulnerable
Ubuntulibssh222.041.10.0-3ubuntu0.1fixed
Ubuntulibssh224.041.11.0-2vulnerable
Ubuntulibssh224.041.11.0-3vulnerable
Ubuntulibssh224.041.11.0-4vulnerable
Ubuntulibssh224.041.11.0-4.1build1vulnerable
Ubuntulibssh224.041.11.0-4.1build2vulnerable
Ubuntulibssh224.041.11.0-4.1ubuntu0.24.04.1vulnerable
Ubuntulibssh224.041.11.0-4.1ubuntu0.24.04.2vulnerable
Ubuntulibssh224.041.11.0-4.1ubuntu0.24.04.3fixed
Ubuntulibssh226.041.11.1-1build1vulnerable
Ubuntulibssh226.041.11.1-1build2vulnerable
Ubuntulibssh226.041.11.1-1ubuntu0.26.04.1vulnerable
Ubuntulibssh226.041.11.1-1ubuntu0.26.04.2vulnerable
Ubuntulibssh226.041.11.1-1ubuntu0.26.04.3fixed
Alpinelibssh23.211.11.1-r3fixed
Alpinelibssh23.221.11.1-r3fixed
Alpinelibssh23.231.11.1-r4fixed
Alpinelibssh23.241.11.1-r4fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibssh2sourcesid1.11.1-5not yet assignedNot reported[1142856]
Debianlibssh2sourceforky1.11.1-5not yet assignedNot reported[1142856]
Debianlibssh2sourcetrixie1.11.1-1+deb13u2not yet assignedNot reported[1142856]
Debianlibssh2sourcebookworm1.10.0-3+deb12u1not yet assignedNot reported[1142856]
Ubuntulibssh2debpro1.8.0-2.1ubuntu0.1+esm1Not reportedUBUNTU-CVE-2026-66034Not reported
Ubuntulibssh2deb22.041.10.0-3ubuntu0.1Not reportedUBUNTU-CVE-2026-66034Not reported
Ubuntulibssh2deb24.041.11.0-4.1ubuntu0.24.04.3Not reportedUBUNTU-CVE-2026-66034Not reported
Ubuntulibssh2deb26.041.11.1-1ubuntu0.26.04.3Not reportedUBUNTU-CVE-2026-66034Not reported
Alpinelibssh2apk3.211.11.1-r3Not reportedALPINE-CVE-2026-66034Not reported
Alpinelibssh2apk3.221.11.1-r3Not reportedALPINE-CVE-2026-66034Not reported
Alpinelibssh2apk3.231.11.1-r4Not reportedALPINE-CVE-2026-66034Not reported
Alpinelibssh2apk3.241.11.1-r4Not reportedALPINE-CVE-2026-66034Not reported

[Debian bug #1142856]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libssh2-1]Affected

    Source package: [libssh2]

    Details (2)

    • 1.10.0-3+b1 · amd64 · bookworm

      Affected · Fixed: 1.10.0-3+deb12u1

      nvd · libssh2 · debian · bookworm; nvd · libssh2 · debian · 12

    • 1.10.0-3+b1 · arm64 · bookworm

      Affected · Fixed: 1.10.0-3+deb12u1

      nvd · libssh2 · debian · bookworm; nvd · libssh2 · debian · 12

  • [libssh2-1-dev]Affected

    Source package: [libssh2]

    Details (2)

    • 1.10.0-3+b1 · amd64 · bookworm

      Affected · Fixed: 1.10.0-3+deb12u1

      nvd · libssh2 · debian · bookworm; nvd · libssh2 · debian · 12

    • 1.10.0-3+b1 · arm64 · bookworm

      Affected · Fixed: 1.10.0-3+deb12u1

      nvd · libssh2 · debian · bookworm; nvd · libssh2 · debian · 12

[Debian 13 (Trixie)]

  • [libssh2-1-dev]Affected

    Source package: [libssh2]

    Details (4)

    • 1.11.1-1+deb13u1 · amd64 · trixie

      Affected · Fixed: 1.11.1-1+deb13u2

      nvd · libssh2 · debian · 13

    • 1.11.1-1+deb13u1 · arm64 · trixie

      Affected · Fixed: 1.11.1-1+deb13u2

      nvd · libssh2 · debian · 13

    • 1.11.1-1+deb13u1 · amd64 · trixie-security

      Affected · Fixed: 1.11.1-1+deb13u2

      nvd · libssh2 · debian · 13

    • 1.11.1-1+deb13u1 · arm64 · trixie-security

      Affected · Fixed: 1.11.1-1+deb13u2

      nvd · libssh2 · debian · 13

  • [libssh2-1t64]Affected

    Source package: [libssh2]

    Details (4)

    • 1.11.1-1+deb13u1 · amd64 · trixie

      Affected · Fixed: 1.11.1-1+deb13u2

      nvd · libssh2 · debian · 13

    • 1.11.1-1+deb13u1 · arm64 · trixie

      Affected · Fixed: 1.11.1-1+deb13u2

      nvd · libssh2 · debian · 13

    • 1.11.1-1+deb13u1 · amd64 · trixie-security

      Affected · Fixed: 1.11.1-1+deb13u2

      nvd · libssh2 · debian · 13

    • 1.11.1-1+deb13u1 · arm64 · trixie-security

      Affected · Fixed: 1.11.1-1+deb13u2

      nvd · libssh2 · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]