CVE-2026-66033

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-66033
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-66033.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-66033
Downstream
AZL (2)
BELL (1)
CGA (6)
DEBIAN (1)
ECHO (1)
JLSEC (1)
MGASA (1)
OESA (3)
openSUSE (2)
RHSA (1)
ROOT (5)
SUSE (9)
UBUNTU (1)
Related
openSUSE (2)
SUSE (9)
Published
2026-07-24T16:35:28Z
Modified
2026-09-14T18:27:00Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
libssh2 Integer Underflow DoS via AES-GCM Cipher Negotiation
Details

libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2_cipher_crypt() function in src/openssl.c that allows a malicious SSH server to crash any connecting client by negotiating AES-GCM ciphers during handshake. Attackers can exploit the underflow in the expression computing blocksize minus aadlen minus authentication tag length to trigger an out-of-bounds read and a memcpy call with a near-SIZE_MAX length argument, causing immediate process crash before any authentication occurs.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-125",
        "CWE-191"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66033.json"
}
References

Affected packages

Git / github.com/libssh2/libssh2

Affected ranges

Type
GIT
Repo
https://github.com/libssh2/libssh2
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
a2ed82d40964bbc0d64cd717aa0a5a892117d2e6
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:libssh2:libssh2:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "1.11.1"
        }
    ],
    "source":  [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

RELEASE.*
RELEASE.0.1
RELEASE.0.10
RELEASE.0.11
RELEASE.0.12
RELEASE.0.13
RELEASE.0.14
RELEASE.0.15
RELEASE.0.16
RELEASE.0.17
RELEASE.0.18
RELEASE.0.3
RELEASE.0.5
RELEASE.0.6
RELEASE.0.7
RELEASE.0.8
RELEASE.1.0
RELEASE.1.1
beforenb-0.*
beforenb-0.14
beforenb2-0.*
beforenb2-0.14
libssh2-1.*
libssh2-1.10.0
libssh2-1.11.0
libssh2-1.11.1
libssh2-1.2
libssh2-1.2.1
libssh2-1.2.3
libssh2-1.2.4
libssh2-1.2.5
libssh2-1.2.6
libssh2-1.2.7
libssh2-1.2.8
libssh2-1.2.9
libssh2-1.3.0
libssh2-1.4.0
libssh2-1.4.1
libssh2-1.4.2
libssh2-1.4.3
libssh2-1.5.0
libssh2-1.6.0
libssh2-1.7.0
libssh2-1.8.0
libssh2-1.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-66033.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "46633703602793041808516286579933556623",
                "279562781493981400548354506450174966742",
                "258491700871900350601374492589103506149",
                "235345207691640829178811662733441267462",
                "283781903113671097521482788622692922695",
                "208608583349629759841085481553437954960",
                "46721559972552605241860937490957983536"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-66033-89f09c5e",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/libssh2/libssh2/commit/a2ed82d40964bbc0d64cd717aa0a5a892117d2e6",
        "target":  {
            "file":  "src/openssl.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "284423643486394263830813353865833030823",
            "length":  1781
        },
        "id":  "CVE-2026-66033-bb286c20",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/libssh2/libssh2/commit/a2ed82d40964bbc0d64cd717aa0a5a892117d2e6",
        "target":  {
            "file":  "src/openssl.c",
            "function":  "ssh2_cipher_crypt"
        }
    }
]
vanir_signatures_modified 
"2026-08-12T16:41:43Z"