CVE-2026-66033 in libssh2
Summary
by MITRE • 07/24/2026
libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2_cipher_crypt() function in src/openssl.c that allows a malicious SSH server to crash any connecting client by negotiating AES-GCM ciphers during handshake. Attackers can exploit the underflow in the expression computing blocksize minus aadlen minus authentication tag length to trigger an out-of-bounds read and a memcpy call with a near-SIZE_MAX length argument, causing immediate process crash before any authentication occurs.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/25/2026
The vulnerability in libssh2 versions through 1.11.1 represents a critical pre-authentication integer underflow that fundamentally compromises client security during the initial SSH handshake process. This flaw exists within the ssh2_cipher_crypt() function located in src/openssl.c and specifically affects the handling of AES-GCM cipher negotiations. The vulnerability is classified as CWE-191 Integer Underflow (Wrap) which directly maps to the underlying mathematical error that occurs when computing cryptographic parameters during cipher setup. The issue manifests when a malicious SSH server attempts to negotiate AES-GCM ciphers with a client, exploiting a calculation error that results in an invalid memory access pattern.
The technical exploitation occurs through a precise arithmetic underflow in the computation involving blocksize minus aadlen minus authentication tag length. This mathematical operation produces a negative value that, when used as a length parameter for memory operations, creates a memcpy call with an argument approaching SIZE_MAX. The vulnerability is particularly dangerous because it operates entirely before any authentication process begins, meaning clients are vulnerable regardless of their credentials or security posture. The underflow triggers immediate out-of-bounds read conditions and subsequent memory corruption that results in process termination, effectively creating a denial-of-service condition that prevents legitimate connections from establishing.
From an operational perspective, this vulnerability represents a sophisticated attack vector that leverages the trust relationship inherent in SSH protocols. The attack requires only a malicious server to be accessible to victims, making it particularly dangerous in environments where clients connect to untrusted or compromised servers. This flaw affects all libssh2-based applications that support AES-GCM cipher suites, including popular tools such as curl, wget, and various SSH client implementations. The vulnerability aligns with ATT&CK technique T1210 Exploitation of Remote Services, specifically targeting the initial connection phase where clients are most vulnerable to pre-authentication attacks. Organizations using libssh2 in production environments face immediate risk of service disruption when clients encounter malicious servers attempting to exploit this vulnerability.
The mitigation strategy centers on upgrading to libssh2 version containing commit a2ed82d which implements proper bounds checking and integer overflow protection in the cipher handling code. System administrators should prioritize patching affected applications that utilize libssh2, particularly those with high-privilege SSH client configurations or those connecting to untrusted networks. Additional protective measures include implementing network segmentation to limit exposure to potentially malicious SSH servers, configuring SSH clients to avoid AES-GCM cipher suites until patched, and monitoring for connection failures that may indicate exploitation attempts. Organizations should also consider implementing network-based intrusion detection systems capable of identifying malicious SSH handshake patterns associated with this specific vulnerability, as the attack pattern is consistent and detectable through protocol analysis.
This vulnerability demonstrates the critical importance of proper integer overflow checking in cryptographic implementations, where mathematical errors can translate directly into system compromise. The fix implemented in commit a2ed82d addresses the root cause by ensuring proper validation of cipher parameters before memory operations occur, preventing the underflow condition that previously enabled the attack. The vulnerability serves as a reminder that even well-established cryptographic libraries require continuous security auditing, particularly in pre-authentication phases where attackers can exploit implementation flaws without requiring valid credentials or prior access to the target system.