CVE-2026-58051
libssh2 - Free of Uninitialized Pointer in publickey List Cleanup
libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2_publickey_list_free operating on an uninitialized entry. A malicious SSH server offering the publickey subsystem can use a malformed response to make cleanup free an uninitialized, attacker-influenceable attrs pointer in a connecting libssh2 client.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
libssh2 - Free of Uninitialized Pointer in publickey List Cleanup
libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2_publickey_list_free operating on an uninitialized entry. A malicious SSH server offering the publickey subsystem can use a malformed response to make cleanup free an uninitialized, attacker-influenceable attrs pointer in a connecting libssh2 client.
- Record
CVE-2026-58051- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-908
- Updated
- 2026-11-02
EUVDEUVD-2026-39971
libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2_publickey_list_free operating on an uninitialized entry. A malicious SSH server offering the publickey subsystem can use a malformed response to make cleanup free an uninitialized, attacker-influenceable attrs pointer in a connecting libssh2 client.
- Record
EUVD-2026-39971- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-c5f3-hwj2-xp5p
libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize...
libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2_publickey_list_free operating on an uninitialized entry. A malicious SSH server offering the publickey subsystem can use a malformed response to make cleanup free an uninitialized, attacker-influenceable attrs pointer in a connecting libssh2 client.
- Record
GHSA-c5f3-hwj2-xp5p- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-908
- Updated
- 2026-11-02
NVD
libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2_publickey_list_free operating on an uninitialized entry. A malicious SSH server offering the publickey subsystem can use a malformed response to make cleanup free an uninitialized, attacker-influenceable attrs pointer in a connecting libssh2 client.
- Record
CVE-2026-58051- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-908
- Updated
- 2026-11-02
OSVALPINE-CVE-2026-58051
libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2_publickey_list_free operating on an uninitialized entry. A malicious SSH server offering the publickey subsystem can use a malformed response to make cleanup free an uninitialized, attacker-influenceable attrs pointer in a connecting libssh2 client.
- Record
ALPINE-CVE-2026-58051- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVBELL-CVE-2026-58051
- Record
BELL-CVE-2026-58051- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
Show 27 moreShow less
OSV
libssh2 - Free of Uninitialized Pointer in publickey List Cleanup
libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2_publickey_list_free operating on an uninitialized entry. A malicious SSH server offering the publickey subsystem can use a malformed response to make cleanup free an uninitialized, attacker-influenceable attrs pointer in a connecting libssh2 client.
- Record
CVE-2026-58051- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-908
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-58051
libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2_publickey_list_free operating on an uninitialized entry. A malicious SSH server offering the publickey subsystem can use a malformed response to make cleanup free an uninitialized, attacker-influenceable attrs pointer in a connecting libssh2 client.
- Record
DEBIAN-CVE-2026-58051- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVJLSEC-2026-663
libssh2 through 1.11.1 grows its publickey list with `SSH2_REALLOC` but does not zero-initialize new...
libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2_publickey_list_free operating on an uninitialized entry. A malicious SSH server offering the publickey subsystem can use a malformed response to make cleanup free an uninitialized, attacker-influenceable attrs pointer in a connecting libssh2 client.
- Record
JLSEC-2026-663- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
OSVRHSA-2026:46535
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:46535- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:46927
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:46927- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-58051
libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2_publickey_list_free operating on an uninitialized entry. A malicious SSH server offering the publickey subsystem can use a malformed response to make cleanup free an uninitialized, attacker-influenceable attrs pointer in a connecting libssh2 client.
- Record
UBUNTU-CVE-2026-58051- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
OSVAZL-91385 No score
CVE-2026-58051 affecting package libssh2 for versions less than 1.11.1-6
libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2_publickey_list_free operating on an uninitialized entry. A malicious SSH server offering the publickey subsystem can use a malformed response to make cleanup free an uninitialized, attacker-influenceable attrs pointer in a connecting libssh2 client.
- Record
AZL-91385- Updated
- 2026-11-05
OSVAZL-97395 No score
CVE-2026-58051 affecting package rust for versions less than 1.75.0-30
libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2_publickey_list_free operating on an uninitialized entry. A malicious SSH server offering the publickey subsystem can use a malformed response to make cleanup free an uninitialized, attacker-influenceable attrs pointer in a connecting libssh2 client.
- Record
AZL-97395- Updated
- 2026-11-05
OSVAZL-97437 No score
CVE-2026-58051 affecting package rust for versions less than 1.96.0-1
libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2_publickey_list_free operating on an uninitialized entry. A malicious SSH server offering the publickey subsystem can use a malformed response to make cleanup free an uninitialized, attacker-influenceable attrs pointer in a connecting libssh2 client.
- Record
AZL-97437- Updated
- 2026-11-05
OSVMGASA-2026-0273 No score
Updated libssh2 packages fix security vulnerabilities
The updated packages fix security vulnerabilities: Heap Buffer Over-read via sftp_symlink() in sftp.c. (CVE-2025-15661) libssh2 userauth.c userauth_password integer overflow. (CVE-2026-7598) Pre-Authentication DoS via SSH_MSG_EXT_INFO Handler. (CVE-2026-55199) Out-of-Bounds Write via Unchecked packet_length in transport.c. (CVE-2026-55200) Integer Overflow in publickey Subsystem Attribute Allocation. (CVE-2026-58050) Free of Uninitialized Pointer in publickey List Cleanup. (CVE-2026-58051)
- Record
MGASA-2026-0273- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11454-1 No score
libssh2-1-1.11.1-4.1 on GA media
These are all security issues fixed in the libssh2-1-1.11.1-4.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11454-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21549-1 No score
Security update for libssh2_org
This update for libssh2_org fixes the following issues:
- CVE-2025-15661: out-of-bounds heap read vulnerability in the
sftp_symlink()function insrc/sftp.c(bsc#1268546). - CVE-2026-7598: integer overflow in function
userauth_passwordof filesrc/userauth.c(bsc#1263890). - CVE-2026-58050: heap buffer overflow due to missing bounds check in attribute count of publickey-subsystem response (bsc#1269568).
- CVE-2026-58051: uninitialized pointer freed when malformed responses are sent by an SSH server (bsc#1269567).
- CVE-2026-66032: arbitrary code execution via double-free in SFTP session (bsc#1272737).
- CVE-2026-66033: denial of service via integer underflow in AES-GCM cipher negotiation (bsc#1272736).
- CVE-2026-66034: information disclosure and potential arbitrary code execution via heap out-of-bounds read (bsc#1272735).
- CVE-2026-66035: arbitrary code execution via heap buffer overflow during SSH negotiation (bsc#1272734).
- Record
openSUSE-SU-2026:21549-1- Updated
- 2026-11-02
OSVROOT-OS-ALPINE-322-CVE-2026-58051 No score
CVE-2026-58051 in libssh2 - Patched by Root
Root has patched CVE-2026-58051 in the libssh2 package for Root:Alpine:3.22. Multiple fixed versions available.
- Record
ROOT-OS-ALPINE-322-CVE-2026-58051- Updated
- 2026-11-02
OSVROOT-OS-ALPINE-323-CVE-2026-58051 No score
CVE-2026-58051 in libssh2 - Patched by Root
Root has patched CVE-2026-58051 in the libssh2 package for Root:Alpine:3.23. Multiple fixed versions available.
- Record
ROOT-OS-ALPINE-323-CVE-2026-58051- Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2026-58051 No score
CVE-2026-58051 in libssh2 - Patched by Root
Root has patched CVE-2026-58051 in the libssh2 package for Root:Debian:12. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-12-CVE-2026-58051- Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2026-58051 No score
CVE-2026-58051 in libssh2 - Patched by Root
Root has patched CVE-2026-58051 in the libssh2 package for Root:Debian:13. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-13-CVE-2026-58051- Updated
- 2026-11-02
OSVSUSE-SU-2026:23049-1 No score
Security update for libssh2_org
This update for libssh2_org fixes the following issues:
- CVE-2025-15661: out-of-bounds heap read vulnerability in the
sftp_symlink()function insrc/sftp.c(bsc#1268546). - CVE-2026-7598: integer overflow in function
userauth_passwordof filesrc/userauth.c(bsc#1263890). - CVE-2026-58050: heap buffer overflow due to missing bounds check in attribute count of publickey-subsystem response (bsc#1269568).
- CVE-2026-58051: uninitialized pointer freed when malformed responses are sent by an SSH server (bsc#1269567).
- CVE-2026-66032: arbitrary code execution via double-free in SFTP session (bsc#1272737).
- CVE-2026-66033: denial of service via integer underflow in AES-GCM cipher negotiation (bsc#1272736).
- CVE-2026-66034: information disclosure and potential arbitrary code execution via heap out-of-bounds read (bsc#1272735).
- CVE-2026-66035: arbitrary code execution via heap buffer overflow during SSH negotiation (bsc#1272734).
- Record
SUSE-SU-2026:23049-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:23187-1 No score
Security update for libssh2_org
This update for libssh2_org fixes the following issues:
- CVE-2025-15661: out-of-bounds heap read vulnerability in the
sftp_symlink()function insrc/sftp.c(bsc#1268546). - CVE-2026-7598: integer overflow in function
userauth_passwordof filesrc/userauth.c(bsc#1263890). - CVE-2026-55199: pre-authentication DoS via the
SSH_MSG_EXT_INFOhandler (bsc#1268530). - CVE-2026-58050: heap buffer overflow due to missing bounds check in attribute count of publickey-subsystem response (bsc#1269568).
- CVE-2026-58051: uninitialized pointer freed when malformed responses are sent by an SSH server (bsc#1269567).
- CVE-2026-66032: arbitrary code execution via double-free in SFTP session (bsc#1272737).
- CVE-2026-66033: denial of service via integer underflow in AES-GCM cipher negotiation (bsc#1272736).
- CVE-2026-66034: information disclosure and potential arbitrary code execution via heap out-of-bounds read (bsc#1272735).
- CVE-2026-66035: arbitrary code execution via heap buffer overflow during SSH negotiation (bsc#1272734).
- Record
SUSE-SU-2026:23187-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:23214-1 No score
Security update for libssh2_org
This update for libssh2_org fixes the following issues:
- CVE-2025-15661: out-of-bounds heap read vulnerability in the
sftp_symlink()function insrc/sftp.c(bsc#1268546). - CVE-2026-7598: integer overflow in function
userauth_passwordof filesrc/userauth.c(bsc#1263890). - CVE-2026-58050: heap buffer overflow due to missing bounds check in attribute count of publickey-subsystem response (bsc#1269568).
- CVE-2026-58051: uninitialized pointer freed when malformed responses are sent by an SSH server (bsc#1269567).
- CVE-2026-66032: arbitrary code execution via double-free in SFTP session (bsc#1272737).
- CVE-2026-66033: denial of service via integer underflow in AES-GCM cipher negotiation (bsc#1272736).
- CVE-2026-66034: information disclosure and potential arbitrary code execution via heap out-of-bounds read (bsc#1272735).
- CVE-2026-66035: arbitrary code execution via heap buffer overflow during SSH negotiation (bsc#1272734).
- Record
SUSE-SU-2026:23214-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:23225-1 No score
Security update for libssh2_org
This update for libssh2_org fixes the following issues:
- CVE-2025-15661: out-of-bounds heap read vulnerability in the
sftp_symlink()function insrc/sftp.c(bsc#1268546). - CVE-2026-7598: integer overflow in function
userauth_passwordof filesrc/userauth.c(bsc#1263890). - CVE-2026-58050: heap buffer overflow due to missing bounds check in attribute count of publickey-subsystem response (bsc#1269568).
- CVE-2026-58051: uninitialized pointer freed when malformed responses are sent by an SSH server (bsc#1269567).
- CVE-2026-66032: arbitrary code execution via double-free in SFTP session (bsc#1272737).
- CVE-2026-66033: denial of service via integer underflow in AES-GCM cipher negotiation (bsc#1272736).
- CVE-2026-66034: information disclosure and potential arbitrary code execution via heap out-of-bounds read (bsc#1272735).
- CVE-2026-66035: arbitrary code execution via heap buffer overflow during SSH negotiation (bsc#1272734).
- Record
SUSE-SU-2026:23225-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:23245-1 No score
Security update for libssh2_org
This update for libssh2_org fixes the following issues:
Security issues fixed:
- CVE-2025-15661: out-of-bounds heap read vulnerability in the
sftp_symlink()function insrc/sftp.c(bsc#1268546). - CVE-2026-7598: integer overflow in function
userauth_passwordof filesrc/userauth.c(bsc#1263890). - CVE-2026-58050: heap buffer overflow due to missing bounds check in attribute count of publickey-subsystem response (bsc#1269568).
- CVE-2026-58051: uninitialized pointer freed when malformed responses are sent by an SSH server (bsc#1269567).
- CVE-2026-66032: arbitrary code execution via double-free in SFTP session (bsc#1272737).
- CVE-2026-66033: denial of service via integer underflow in AES-GCM cipher negotiation (bsc#1272736).
- CVE-2026-66034: information disclosure and potential arbitrary code execution via heap out-of-bounds read (bsc#1272735).
- CVE-2026-66035: arbitrary code execution via heap buffer overflow during SSH negotiation (bsc#1272734).
Other updates and bugfixes:
- Fix an issue with Encrypt-then-MAC family (bsc#1221622).
- Test the ETM feature in the remote end's configuration when receiving data. Upstream issue: #1331.
- Always add the KEX pseudo-methods
ext-info-cand[email protected]when configuring custom method list (bsc#1218971).- The strict-kex extension is announced in the list of available KEX methods. However, when the default KEX method list is modified or replaced, the extension is not added back automatically.
- Record
SUSE-SU-2026:23245-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:3525-1 No score
Security update for libssh2_org
This update for libssh2_org fixes the following issues:
- CVE-2025-15661: out-of-bounds heap read vulnerability in the
sftp_symlink()function insrc/sftp.c(bsc#1268546). - CVE-2026-7598: integer overflow in function
userauth_passwordof filesrc/userauth.c(bsc#1263890). - CVE-2026-55199: pre-authentication DoS via the
SSH_MSG_EXT_INFOhandler (bsc#1268530). - CVE-2026-58050: heap buffer overflow due to missing bounds check in attribute count of publickey-subsystem response (bsc#1269568).
- CVE-2026-58051: uninitialized pointer freed when malformed responses are sent by an SSH server (bsc#1269567).
- CVE-2026-66032: arbitrary code execution via double-free in SFTP session (bsc#1272737).
- CVE-2026-66033: denial of service via integer underflow in AES-GCM cipher negotiation (bsc#1272736).
- CVE-2026-66034: information disclosure and potential arbitrary code execution via heap out-of-bounds read (bsc#1272735).
- CVE-2026-66035: arbitrary code execution via heap buffer overflow during SSH negotiation (bsc#1272734).
- Record
SUSE-SU-2026:3525-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:3526-1 No score
Security update for libssh2_org
This update for libssh2_org fixes the following issues:
- CVE-2025-15661: out-of-bounds heap read vulnerability in the
sftp_symlink()function insrc/sftp.c(bsc#1268546). - CVE-2026-7598: integer overflow in function
userauth_passwordof filesrc/userauth.c(bsc#1263890). - CVE-2026-58050: heap buffer overflow due to missing bounds check in attribute count of publickey-subsystem response (bsc#1269568).
- CVE-2026-58051: uninitialized pointer freed when malformed responses are sent by an SSH server (bsc#1269567).
- CVE-2026-66032: arbitrary code execution via double-free in SFTP session (bsc#1272737).
- CVE-2026-66033: denial of service via integer underflow in AES-GCM cipher negotiation (bsc#1272736).
- CVE-2026-66034: information disclosure and potential arbitrary code execution via heap out-of-bounds read (bsc#1272735).
- CVE-2026-66035: arbitrary code execution via heap buffer overflow during SSH negotiation (bsc#1272734).
- Record
SUSE-SU-2026:3526-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:3541-1 No score
Security update for libssh2_org
This update for libssh2_org fixes the following issues:
- CVE-2025-15661: out-of-bounds heap read vulnerability in the
sftp_symlink()function insrc/sftp.c(bsc#1268546). - CVE-2026-7598: integer overflow in function
userauth_passwordof filesrc/userauth.c(bsc#1263890). - CVE-2026-58050: heap buffer overflow due to missing bounds check in attribute count of publickey-subsystem response (bsc#1269568).
- CVE-2026-58051: uninitialized pointer freed when malformed responses are sent by an SSH server (bsc#1269567).
- CVE-2026-66032: arbitrary code execution via double-free in SFTP session (bsc#1272737).
- CVE-2026-66033: denial of service via integer underflow in AES-GCM cipher negotiation (bsc#1272736).
- CVE-2026-66034: information disclosure and potential arbitrary code execution via heap out-of-bounds read (bsc#1272735).
- CVE-2026-66035: arbitrary code execution via heap buffer overflow during SSH negotiation (bsc#1272734).
- Record
SUSE-SU-2026:3541-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:4095-1 No score
Security update for libssh2_org
This update for libssh2_org fixes the following issues:
- CVE-2025-15661: out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c (bsc#1268546).
- CVE-2026-7598: integer overflow in function
userauth_passwordof filesrc/userauth.c(bsc#1263890). - CVE-2026-58050: attacker controlled attribute count from a publickey-subsystem response is used without bounds checking and can cause to a heap buffer overflow in a connecting libssh2 client (bsc#1269568).
- CVE-2026-58051: public key list is increased and does not zero-initialized new entries, which can cause an uninitialized pointer to be freed when a malformed response is sent by an SSH server (bsc#1269567).
- CVE-2026-66032: Arbitrary code execution via double-free in SFTP session (bsc#1272737).
- CVE-2026-66033: Denial of Service via integer underflow in AES-GCM cipher negotiation (bsc#1272736).
- CVE-2026-66034: Information disclosure and potential arbitrary code execution via heap out-of-bounds read (bsc#1272735).
- CVE-2026-66035: Arbitrary code execution via heap buffer overflow during SSH negotiation (bsc#1272734).
- Record
SUSE-SU-2026:4095-1- Updated
- 2026-11-02
OSVUSN-8532-1 No score
libssh2 vulnerabilities
It was discovered that libssh2 incorrectly handled certain publickey subsystem attributes. A remote attacker controlling a malicious SSH server could use this issue to cause a denial of service or possibly execute arbitrary code. (CVE-2026-58050)
It was discovered that libssh2 did not properly initialize publickey list entries before parsing. A remote attacker controlling a malicious SSH server could use this issue to cause a denial of service or possibly execute arbitrary code. (CVE-2026-58051)
- Record
USN-8532-1- Updated
- 2026-11-02
OSVUSN-8799-1 No score
libssh2 vulnerabilities
It was discovered that libssh2 incorrectly handled certain publickey subsystem attributes. A remote attacker controlling a malicious SSH server could use this issue to cause a denial of service or possibly execute arbitrary code. (CVE-2026-58050)
It was discovered that libssh2 did not properly initialize publickey list entries before parsing. A remote attacker controlling a malicious SSH server could use this issue to cause a denial of service or possibly execute arbitrary code. (CVE-2026-58051)
It was discovered that libssh2 incorrectly handled certain SFTP server responses. A remote attacker controlling an SSH server could use this issue to cause libssh2 to crash or possibly execute arbitrary code. (CVE-2026-66032)
It was discovered that libssh2 did not properly check bounds in certain publickey subsystem responses. A remote attacker controlling a malicious SSH server could use this issue to cause a denial of service or possibly execute arbitrary code.. (CVE-2026-66034)
- Record
USN-8799-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libssh2Alpine:v3.21 |
before 1.11.1-r3 | 1.11.1-r3 |
libssh2Alpine:v3.22 |
before 1.11.1-r3 | 1.11.1-r3 |
libssh2Alpine:v3.23 |
before 1.11.1-r4 | 1.11.1-r4 |
libssh2Alpine:v3.24 |
before 1.11.1-r4 | 1.11.1-r4 |
libssh2Azure Linux:3 |
before 1.11.1-6 | 1.11.1-6 |
rustAzure Linux:3 |
before 1.75.0-30 | 1.75.0-30 |
rustAzure Linux:3 |
1.85.0 up to 1.96.0-1 | 1.96.0-1 |
libssh2Alpaquita:23 |
1.10.0-r4 up to 1.11.1-r4 | 1.11.1-r4 |
libssh2Alpaquita:25 |
1.11.1-r0 up to 1.11.1-r4 | 1.11.1-r4 |
libssh2Alpaquita:stream |
1.10.0-r4 up to 1.11.1-r5 | 1.11.1-r5 |
Show 53 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libssh2Debian:12 |
before 1.10.0-3+deb12u1, plus listed versions 1.10.0-3 |
1.10.0-3+deb12u1 |
libssh2Debian:13 |
before 1.11.1-1+deb13u2, plus listed versions 1.11.1-11.11.1-1+deb13u1 |
1.11.1-1+deb13u2 |
libssh2Debian:14 |
before 1.11.1-6, plus listed versions 1.11.1-11.11.1-21.11.1-31.11.1-41.11.1-5 |
1.11.1-6 |
LibSSH2_jllJulia |
before 1.11.103+0 | 1.11.103+0 |
libssh2Mageia:10 From an advisory covering 6 CVEs |
before 1.11.1-2.1.mga10 | 1.11.1-2.1.mga10 |
libssh2Mageia:9 From an advisory covering 6 CVEs |
before 1.11.0-1.1.mga9 | 1.11.0-1.1.mga9 |
libssh2Red Hat:hummingbird:1 |
before 0:1.11.1-10.1.hum1 | 0:1.11.1-10.1.hum1 |
libssh2-develRed Hat:hummingbird:1 |
before 0:1.11.1-10.1.hum1 | 0:1.11.1-10.1.hum1 |
libssh2-docsRed Hat:hummingbird:1 |
before 0:1.11.1-10.1.hum1 | 0:1.11.1-10.1.hum1 |
libssh2Red Hat:hummingbird:1 From an advisory covering 4 CVEs |
before 0:1.11.1-10.2.hum1 | 0:1.11.1-10.2.hum1 |
libssh2-develRed Hat:hummingbird:1 From an advisory covering 4 CVEs |
before 0:1.11.1-10.2.hum1 | 0:1.11.1-10.2.hum1 |
libssh2-docsRed Hat:hummingbird:1 From an advisory covering 4 CVEs |
before 0:1.11.1-10.2.hum1 | 0:1.11.1-10.2.hum1 |
libssh2_orgSUSE:Linux Micro 6.2 From an advisory covering 8 CVEs |
before 1.11.1-160000.5.1 | 1.11.1-160000.5.1 |
libssh2_orgSUSE:Linux Micro 6.1 From an advisory covering 9 CVEs |
before 1.11.0-slfo.1.1_2.1 | 1.11.0-slfo.1.1_2.1 |
libssh2_orgSUSE:Linux Enterprise Server 16.0 From an advisory covering 8 CVEs |
before 1.11.1-160000.5.1 | 1.11.1-160000.5.1 |
libssh2_orgSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 8 CVEs |
before 1.11.1-160000.5.1 | 1.11.1-160000.5.1 |
libssh2_orgSUSE:Linux Micro 6.0 From an advisory covering 8 CVEs |
before 1.11.0-4.1 | 1.11.0-4.1 |
libssh2_orgSUSE:Linux Enterprise Server 12 SP5-LTSS From an advisory covering 9 CVEs |
before 1.11.0-29.18.1 | 1.11.0-29.18.1 |
libssh2_orgSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 From an advisory covering 9 CVEs |
before 1.11.0-29.18.1 | 1.11.0-29.18.1 |
libssh2_orgSUSE:Linux Enterprise Micro 5.3 From an advisory covering 8 CVEs |
before 1.11.0-150200.9.8.1 | 1.11.0-150200.9.8.1 |
libssh2_orgSUSE:Linux Enterprise Micro 5.4 From an advisory covering 8 CVEs |
before 1.11.0-150200.9.8.1 | 1.11.0-150200.9.8.1 |
libssh2_orgSUSE:Linux Enterprise Micro 5.5 From an advisory covering 8 CVEs |
before 1.11.0-150200.9.8.1 | 1.11.0-150200.9.8.1 |
libssh2_orgSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 8 CVEs |
before 1.11.0-150200.9.8.1 | 1.11.0-150200.9.8.1 |
libssh2_orgSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 8 CVEs |
before 1.11.0-150200.9.8.1 | 1.11.0-150200.9.8.1 |
libssh2_orgSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 8 CVEs |
before 1.11.0-150200.9.8.1 | 1.11.0-150200.9.8.1 |
libssh2_orgSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 8 CVEs |
before 1.11.0-150200.9.8.1 | 1.11.0-150200.9.8.1 |
libssh2_orgSUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 8 CVEs |
before 1.11.0-150200.9.8.1 | 1.11.0-150200.9.8.1 |
libssh2_orgSUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 8 CVEs |
before 1.11.0-150200.9.8.1 | 1.11.0-150200.9.8.1 |
libssh2_orgSUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 8 CVEs |
before 1.11.0-150200.9.8.1 | 1.11.0-150200.9.8.1 |
libssh2_orgSUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 8 CVEs |
before 1.11.0-150200.9.8.1 | 1.11.0-150200.9.8.1 |
libssh2_orgSUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 8 CVEs |
before 1.11.0-150600.20.6.1 | 1.11.0-150600.20.6.1 |
libssh2_orgSUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 8 CVEs |
before 1.11.0-150600.20.6.1 | 1.11.0-150600.20.6.1 |
libssh2_orgSUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 8 CVEs |
before 1.11.0-150600.20.6.1 | 1.11.0-150600.20.6.1 |
libssh2_orgSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 8 CVEs |
before 1.11.0-150000.4.35.1 | 1.11.0-150000.4.35.1 |
libssh2_orgSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 8 CVEs |
before 1.11.0-150000.4.35.1 | 1.11.0-150000.4.35.1 |
libssh2_orgSUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 8 CVEs |
before 1.11.0-150000.4.35.1 | 1.11.0-150000.4.35.1 |
libssh2Ubuntu:Pro:14.04:LTS |
before 1.4.3-2ubuntu0.2+esm4, plus listed versions 1.4.3-11.4.3-21.4.3-2ubuntu0.11.4.3-2ubuntu0.21.4.3-2ubuntu0.2+esm11.4.3-2ubuntu0.2+esm21.4.3-2ubuntu0.2+esm3 |
1.4.3-2ubuntu0.2+esm4 |
libssh2Ubuntu:Pro:16.04:LTS |
before 1.5.0-2ubuntu0.1+esm3, plus listed versions 1.5.0-21.5.0-2ubuntu0.11.5.0-2ubuntu0.1+esm11.5.0-2ubuntu0.1+esm2 |
1.5.0-2ubuntu0.1+esm3 |
libssh2Ubuntu:Pro:18.04:LTS |
before 1.8.0-1ubuntu0.1+esm1, plus listed versions 1.8.0-11.8.0-1ubuntu0.1 |
1.8.0-1ubuntu0.1+esm1 |
libssh2Ubuntu:Pro:20.04:LTS |
before 1.8.0-2.1ubuntu0.1+esm1, plus listed versions 1.8.0-2.1build11.8.0-2.1ubuntu0.1 |
1.8.0-2.1ubuntu0.1+esm1 |
libssh2Ubuntu:22.04:LTS |
before 1.10.0-3ubuntu0.1, plus listed versions 1.9.0-31.10.0-21.10.0-2build11.10.0-3 |
1.10.0-3ubuntu0.1 |
libssh2Ubuntu:24.04:LTS |
before 1.11.0-4.1ubuntu0.24.04.3, plus listed versions 1.11.0-21.11.0-31.11.0-41.11.0-4.1build11.11.0-4.1build21.11.0-4.1ubuntu0.24.04.11.11.0-4.1ubuntu0.24.04.2 |
1.11.0-4.1ubuntu0.24.04.3 |
libssh2Ubuntu:25.10 |
All versions, plus listed versions 1.11.1-11.11.1-1build11.11.1-1ubuntu0.25.10.11.11.1-1ubuntu0.25.10.2 |
None known |
libssh2Ubuntu:26.04:LTS |
before 1.11.1-1ubuntu0.26.04.3, plus listed versions 1.11.1-1build11.11.1-1build21.11.1-1ubuntu0.26.04.11.11.1-1ubuntu0.26.04.2 |
1.11.1-1ubuntu0.26.04.3 |
libssh2Ubuntu:24.04:LTS From an advisory covering 2 CVEs |
before 1.11.0-4.1ubuntu0.24.04.3, plus listed versions 1.11.0-21.11.0-31.11.0-41.11.0-4.1build11.11.0-4.1build21.11.0-4.1ubuntu0.24.04.11.11.0-4.1ubuntu0.24.04.2 |
1.11.0-4.1ubuntu0.24.04.3 |
libssh2Ubuntu:26.04:LTS From an advisory covering 2 CVEs |
before 1.11.1-1ubuntu0.26.04.3, plus listed versions 1.11.1-1build11.11.1-1build21.11.1-1ubuntu0.26.04.11.11.1-1ubuntu0.26.04.2 |
1.11.1-1ubuntu0.26.04.3 |
libssh2Ubuntu:Pro:14.04:LTS From an advisory covering 4 CVEs |
before 1.4.3-2ubuntu0.2+esm4, plus listed versions 1.4.3-11.4.3-21.4.3-2ubuntu0.11.4.3-2ubuntu0.21.4.3-2ubuntu0.2+esm11.4.3-2ubuntu0.2+esm21.4.3-2ubuntu0.2+esm3 |
1.4.3-2ubuntu0.2+esm4 |
libssh2Ubuntu:Pro:16.04:LTS From an advisory covering 4 CVEs |
before 1.5.0-2ubuntu0.1+esm3, plus listed versions 1.5.0-21.5.0-2ubuntu0.11.5.0-2ubuntu0.1+esm11.5.0-2ubuntu0.1+esm2 |
1.5.0-2ubuntu0.1+esm3 |
libssh2Ubuntu:Pro:18.04:LTS From an advisory covering 4 CVEs |
before 1.8.0-1ubuntu0.1+esm1, plus listed versions 1.8.0-11.8.0-1ubuntu0.1 |
1.8.0-1ubuntu0.1+esm1 |
libssh2Ubuntu:Pro:20.04:LTS From an advisory covering 4 CVEs |
before 1.8.0-2.1ubuntu0.1+esm1, plus listed versions 1.8.0-2.1build11.8.0-2.1ubuntu0.1 |
1.8.0-2.1ubuntu0.1+esm1 |
libssh2Ubuntu:22.04:LTS From an advisory covering 4 CVEs |
before 1.10.0-3ubuntu0.1, plus listed versions 1.9.0-31.10.0-21.10.0-2build11.10.0-3 |
1.10.0-3ubuntu0.1 |
libssh2_orgopenSUSE:Tumbleweed From an advisory covering 6 CVEs |
before 1.11.1-4.1 | 1.11.1-4.1 |
libssh2_orgopenSUSE:Leap 16.0 From an advisory covering 8 CVEs |
before 1.11.1-160000.5.1 | 1.11.1-160000.5.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-58051 is a high vulnerability (CVSS 8.3) in Libssh2, published June 28, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. Fixed in libssh2 1.11.1-r3.
References
github.com/bikini/exploitarium/tree/main/libssh2-publickey-list-calc-poc
vulncheck.com/advisories/libssh2-free-of-uninitialized-pointer-in-publickey-list-cleanup
nvd.nist.gov/vuln/detail/CVE-2026-58051
security.alpinelinux.org/vuln/CVE-2026-58051
Show 77 moreShow less
docs.bell-sw.com/security/cves/CVE-2026-58051
security-tracker.debian.org/tracker/CVE-2026-58051
advisories.mageia.org/MGASA-2026-0273.html
bugs.mageia.org/show_bug.cgi?id=35616
lists.fedoraproject.org/archives/list/[email protected]/message/NRU63FODXZBBO73NFWUI32A2A36ETDQZ
openwall.com/lists/oss-security/2026/06/23/10
lists.debian.org/debian-security-announce/2026/msg00276.html
lists.opensuse.org/archives/list/[email protected]/message/SRBHQ76PA4ZHTWY5F4ESYPYF3G2NLGWI
ubuntu.com/security/notices/USN-8486-1
access.redhat.com/errata/RHSA-2026:46535
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_46535.json
bugzilla.redhat.com/show_bug.cgi?id=2493950
cve.org/CVERecord?id=CVE-2026-58051
suse.com/support/update/announcement/2026/suse-su-202623049-1
bugzilla.suse.com/1263890