libssh2 Flaws Let Malicious SSH Servers Corrupt Client Memory

TL;DR

Four new libssh2 vulnerabilities put SSH and SFTP clients at risk. Each one lets a malicious SSH server corrupt memory on the machine that connects to it. VulnCheck disclosed the flaws on July 24, 2026, and upstream fixes are ready.

Why it matters

libssh2 sits inside countless tools that speak SSH. It ships with package managers, Git clients, and many programming libraries. Therefore, the risk flips the usual model. Here the server attacks the client, not the other way around. A user who connects to a rogue or hijacked server can suffer heap corruption. Two of the flaws even strike before authentication finishes.

How the attacks work

Pre-authentication memory corruption

CVE-2026-66035 triggers a heap overflow during Encrypt-then-MAC negotiation. A short packet makes the client copy too many bytes. The upstream commit corrects the length check. CVE-2026-66033 underflows a size calculation during AES-GCM setup, which crashes the client. Its fix restores proper bounds.

Post-authentication and key parsing

CVE-2026-66032 frees the same SFTP buffer twice, and the patch removes the double free. CVE-2026-66034 reads past a public-key buffer and frees an uninitialized pointer. That leak exposes heap addresses and undermines ASLR. The commit adds the missing bounds check.

Affected versions

All four bugs affect libssh2 through version 1.11.1. The SFTP double-free and the AES-GCM underflow carry the highest CVSS score, 8.7. The other two rate 7.7. VulnCheck assigned all four identifiers.

Patch and mitigation

Update to the patched release beyond 1.11.1, or apply the four upstream commits directly. Until you patch, connect only to trusted SSH servers. So far, no public exploit or in-the-wild abuse of these libssh2 vulnerabilities has been confirmed.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.