# CVE-2026-58051: libssh2 uninitialized pointer free in publickey list cleanup

Source: https://junglewise.ai/threats/cve-2026-58051-libssh2-uninitialized-pointer-free-in-publickey-list-cleanup  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-28. Updated: 2026-06-28  
License: CC BY 4.0 with a link back

CVE-2026-58051 · Severity: medium · CVSS 6.5 · Published 2026-06-28

libssh2 is a widely used software library that allows applications to communicate securely using the SSH protocol. A flaw in how the library handles public key lists could allow a malicious server to crash or potentially compromise a client application that connects to it. This occurs when the library fails to properly clear memory before processing server responses, leading to errors during cleanup if the server sends specially crafted, malformed data.

Technologies: [Libssh2](https://junglewise.ai/threats/technologies/libssh2). Vendors: [Libssh2](https://junglewise.ai/threats/vendors/libssh2).

## Quick answers

**Is CVE-2026-58051 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-58051 being exploited in the wild.

**How severe is CVE-2026-58051?** Medium severity, with a CVSS score of 6.5, published 28 June 2026.

**Which products and versions are affected?** Libssh2 through 1.11.1.

**Is there a fix for CVE-2026-58051?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-58051 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-58051?** Check whether you run Libssh2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in libssh2 through version 1.11.1 due to the use of uninitialized memory in the publickey subsystem. When the library expands its publickey list using SSH2_REALLOC, it fails to zero-initialize new entries. If a malicious SSH server provides a malformed response that triggers a parsing failure, the library enters a cleanup path where libssh2_publickey_list_free attempts to free an uninitialized 'attrs' pointer. Because the value of this pointer may be influenced by previous memory contents (attacker-influenceable), this can lead to an invalid free, resulting in a denial of service or potentially remote code execution. The attack requires a client to connect to a compromised or malicious SSH server.

## Affected products

- libssh2 libssh2 through 1.11.1

## Timeline

- 2026-06-28: disclosed
- 2026-06-28: advisory

## References

- [https://github.com/bikini/exploitarium/tree/main/libssh2-publickey-list-calc-poc](https://github.com/bikini/exploitarium/tree/main/libssh2-publickey-list-calc-poc)
- [https://github.com/libssh2/libssh2/blob/master/src/publickey.c](https://github.com/libssh2/libssh2/blob/master/src/publickey.c)
- [https://www.vulncheck.com/advisories/libssh2-free-of-uninitialized-pointer-in-publickey-list-cleanup](https://www.vulncheck.com/advisories/libssh2-free-of-uninitialized-pointer-in-publickey-list-cleanup)

## Related threats

- [libssh2 heap buffer overflow in transport layer during EtM negotiation](https://junglewise.ai/threats/cve-2026-66035-libssh2-heap-buffer-overflow-in-transport-layer-during-etm)
- [libssh2 heap out-of-bounds read in publickey_list_fetch](https://junglewise.ai/threats/cve-2026-66034-libssh2-heap-out-of-bounds-read-in-publickey-list-fetch)
- [libssh2 integer underflow in ssh2_cipher_crypt](https://junglewise.ai/threats/cve-2026-66033-libssh2-integer-underflow-in-ssh2-cipher-crypt)
- [libssh2 double free in sftp_open](https://junglewise.ai/threats/cve-2026-66032-libssh2-double-free-in-sftp-open)
- [libssh2 heap buffer overflow in publickey-subsystem attribute allocation](https://junglewise.ai/threats/cve-2026-58050-libssh2-heap-buffer-overflow-in-publickey-subsystem-attribute)