CVE-2026-58050

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-58050
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58050.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-58050
Downstream
AZL (2)
BELL (1)
CGA (6)
DEBIAN (1)
ECHO (1)
JLSEC (1)
MGASA (1)
OESA (5)
openSUSE (2)
RHSA (2)
ROOT (4)
SUSE (9)
UBUNTU (1)
Related
openSUSE (2)
SUSE (9)
Published
2026-06-28T01:32:53Z
Modified
2026-09-14T18:26:49Z
Severity
  • 8.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
libssh2 - Integer Overflow in publickey Subsystem Attribute Allocation
Details

libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation num_attrs * sizeof(libssh2_publickey_attribute) without bounds checking, so on 32-bit platforms the multiplication overflows to an undersized buffer. A malicious SSH server can then drive the attribute-parsing loop to write past the allocation, causing a heap buffer overflow in a connecting libssh2 client.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-190"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58050.json"
}
References

Affected packages

Git / github.com/libssh2/libssh2

Affected ranges

Type
GIT
Repo
https://github.com/libssh2/libssh2
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
a312b43325e3383c865a87bb1d26cb52e3292641
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:libssh2:libssh2:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "1.11.1"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

RELEASE.*
RELEASE.0.1
RELEASE.0.10
RELEASE.0.11
RELEASE.0.12
RELEASE.0.13
RELEASE.0.14
RELEASE.0.15
RELEASE.0.16
RELEASE.0.17
RELEASE.0.18
RELEASE.0.3
RELEASE.0.5
RELEASE.0.6
RELEASE.0.7
RELEASE.0.8
RELEASE.1.0
RELEASE.1.1
beforenb-0.*
beforenb-0.14
beforenb2-0.*
beforenb2-0.14
libssh2-1.*
libssh2-1.10.0
libssh2-1.11.0
libssh2-1.11.1
libssh2-1.2
libssh2-1.2.1
libssh2-1.2.3
libssh2-1.2.4
libssh2-1.2.5
libssh2-1.2.6
libssh2-1.2.7
libssh2-1.2.8
libssh2-1.2.9
libssh2-1.3.0
libssh2-1.4.0
libssh2-1.4.1
libssh2-1.4.2
libssh2-1.4.3
libssh2-1.5.0
libssh2-1.6.0
libssh2-1.7.0
libssh2-1.8.0
libssh2-1.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58050.json"