Executive brief
libssh2 is a widely used software library that allows applications to communicate securely using the SSH protocol. A flaw in how the library handles public key lists could allow a malicious server to crash or potentially compromise a client application that connects to it. This occurs when the library fails to properly clear memory before processing server responses, leading to errors during cleanup if the server sends specially crafted, malformed data.
Technical details
A vulnerability exists in libssh2 through version 1.11.1 due to the use of uninitialized memory in the publickey subsystem. When the library expands its publickey list using SSH2_REALLOC, it fails to zero-initialize new entries. If a malicious SSH server provides a malformed response that triggers a parsing failure, the library enters a cleanup path where libssh2_publickey_list_free attempts to free an uninitialized 'attrs' pointer. Because the value of this pointer may be influenced by previous memory contents (attacker-influenceable), this can lead to an invalid free, resulting in a denial of service or potentially remote code execution. The attack requires a client to connect to a compromised or malicious SSH server.
Affected products
- libssh2 libssh2 through 1.11.1
Timeline
- 2026-06-28: disclosed
- 2026-06-28: advisory