Executive brief
libssh2 is a widely used software library that allows applications to communicate securely using the SSH protocol. A security flaw in certain versions allows a malicious server to crash or potentially take control of a client application when it attempts to connect. This could lead to service disruptions or unauthorized access to data on the system using the library.
Technical details
A vulnerability exists in libssh2 through version 1.11.1 where the publickey-subsystem response processing fails to perform bounds checking on an attacker-controlled 32-bit attribute count. On 32-bit platforms, the calculation 'num_attrs * sizeof(libssh2_publickey_attribute)' can result in an integer overflow, leading to an undersized heap buffer allocation. A malicious SSH server can then provide more attributes than the buffer can hold, resulting in a heap buffer overflow. This attack requires a client to connect to a compromised or malicious SSH server. While the CVSS score is 7.0, some assessments suggest a higher severity of 8.3 (CVSS 4.0).
Affected products
- libssh2 libssh2 through 1.11.1
Timeline
- 2026-06-27: disclosed: Initial disclosure by VulnCheck
- 2026-06-28: advisory: NVD publication date