Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.7
CVE-2026-66034: libssh2: Malicious SSH Server Can Leak Sensitive Information
CVE-2026-66034
CVE-2026-66034
Summary
A security flaw in libssh2 allows a malicious SSH server to potentially leak sensitive information. This affects systems using libssh2 version 1.11.1 or earlier. To fix this issue, update to the latest version of libssh2, specifically the one that includes the fix for this vulnerability.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| libssh2 | libssh2 | <= 1.11.1 |
Original title
libssh2 Heap Out-of-Bounds Read via publickey subsystem
Original description
libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of an uninitialized pointer via the publickey subsystem. In libssh2_publickey_list_fetch(), the version 1 response parser reads a server-controlled comment_len value and advances the parse pointer without verifying sufficient bytes remain in the buffer, causing the out-of-bounds read to leak heap pointers from adjacent allocations defeating ASLR, followed by heap allocator state corruption when the error cleanup path frees an uninitialized pointer from a non-zeroed realloc() region.
nvd CVSS3.1
7.5
nvd CVSS4.0
7.7
Vulnerability type
CWE-125
Out-of-bounds Read
CWE-908
Use of Uninitialized Resource
Published: 24 Jul 2026 · Updated: 25 Jul 2026 · First seen: 24 Jul 2026