Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Oracle libssh2 can overflow when listing public keys
published 3 months ago
Summary
The libssh2 library used by Oracle’s libssh2, libssh2-devel and libssh2-docs packages could miscalculate the number of public keys and cause a 32‑bit math error. This error may let an attacker cause the program to crash or potentially run unwanted code. Apply the latest security update for the affected Oracle packages to fix the issue.
What to do
- Update oracle libssh2 to version 1.4.2-3.0.1.el6_10.1.tuxcare.ol.els6.
- Update oracle libssh2-devel to version 1.4.2-3.0.1.el6_10.1.tuxcare.ol.els6.
- Update oracle libssh2-docs to version 1.4.2-3.0.1.el6_10.1.tuxcare.ol.els6.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:OracleLinux:6 | oracle | libssh2 |
< 1.4.2-3.0.1.el6_10.1.tuxcare.ol.els6 Fix: upgrade to 1.4.2-3.0.1.el6_10.1.tuxcare.ol.els6
|
| TuxCare:OracleLinux:6 | oracle | libssh2-devel |
< 1.4.2-3.0.1.el6_10.1.tuxcare.ol.els6 Fix: upgrade to 1.4.2-3.0.1.el6_10.1.tuxcare.ol.els6
|
| TuxCare:OracleLinux:6 | oracle | libssh2-docs |
< 1.4.2-3.0.1.el6_10.1.tuxcare.ol.els6 Fix: upgrade to 1.4.2-3.0.1.el6_10.1.tuxcare.ol.els6
|
Original advisory text
libssh2: Fix of CVE-2026-58050
- CVE-2026-58050: cap publickey list attribute count to prevent 32-bit multiplication overflow in libssh2_publickey_list_fetch()
References
- https://errata.tuxcare.com/els_os/oraclelinux6els/CLSA-2026-1785308535.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-58050 Vendor Advisory
Timeline
Published29 Jul 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1785308535 · OSV
Track software like this
Free during beta