Executive brief
libssh2 is a widely used library that allows applications to communicate securely using the SSH protocol. A flaw in how the library handles certain SFTP responses could allow a malicious server or a man-in-the-middle attacker to crash the application or potentially access sensitive information from the computer's memory. This could lead to service disruptions or the exposure of private data during secure file transfer operations.
Technical details
An out-of-bounds (OOB) heap read vulnerability exists in libssh2 through version 1.11.1 within the sftp_symlink() function in src/sftp.c. The issue stems from missing validation of the available packet buffer size before a memcpy operation when processing SSH_FXP_NAME responses for SFTP READLINK and REALPATH operations. A malicious SSH server or man-in-the-middle attacker can provide a link_len value larger than the actual packet data, triggering a buffer over-read. This can result in the disclosure of heap memory contents or a denial-of-service (crash). The vulnerability is fixed in commit 2dae302 by implementing a buffer struct to enforce bounds checking.
Affected products
- libssh2 libssh2 through 1.11.1
Timeline
- 2025-10-10: patched: Fix merged into master branch via commit 2dae302
- 2026-06-18: disclosed: CVE published and NVD record created