libssh2 up to 1.11.1 publickey subsystem libssh2_publickey_list_fetch out-of-bounds

Summaryinfo

A vulnerability, which was classified as critical, was found in libssh2 up to 1.11.1. Affected is the function libssh2_publickey_list_fetch of the component publickey subsystem. The manipulation results in out-of-bounds. This vulnerability is identified as CVE-2026-66034. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as critical has been found in libssh2 up to 1.11.1. Affected is the function libssh2_publickey_list_fetch of the component publickey subsystem. The manipulation with an unknown input leads to a out-of-bounds vulnerability. CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of an uninitialized pointer via the publickey subsystem. In libssh2_publickey_list_fetch(), the version 1 response parser reads a server-controlled comment_len value and advances the parse pointer without verifying sufficient bytes remain in the buffer, causing the out-of-bounds read to leak heap pointers from adjacent allocations defeating ASLR, followed by heap allocator state corruption when the error cleanup path frees an uninitialized pointer from a non-zeroed realloc() region.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-66034 since 07/23/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are known, but there is no available exploit.

Applying the patch a13bb6c773f0d55ad1628cede57e99803cd898d9 is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-48721). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• libssh2

Version

• 1.11.0
• 1.11.1

Website

• Product: https://github.com/libssh2/libssh2/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion