AZL-93396

libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftpopen() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSHFXPOPEN with SSHFXPSTATUS containing FXOK, the response data buffer is freed, and if a subsequent sftppacketrequire() call returns a specific error such as LIBSSH2ERRORCHANNELPACKETEXCEEDED, the same pointer is freed a second time, enabling tcache dup conditions on glibc systems that allow overlapping allocations and function pointer overwrites.