CVE-2026-66034

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-66034
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-66034.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-66034
Downstream
ALPINE (1)
AZL (2)
BELL (1)
CGA (6)
DEBIAN (1)
ECHO (1)
JLSEC (1)
OESA (5)
openSUSE (2)
RHSA (2)
ROOT (5)
SUSE (9)
UBUNTU (1)
Related
openSUSE (2)
SUSE (9)
Published
2026-07-24T16:42:18Z
Modified
2026-10-21T10:35:54Z
Severity
  • 7.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
libssh2 Heap Out-of-Bounds Read via publickey subsystem
Details

libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of an uninitialized pointer via the publickey subsystem. In libssh2_publickey_list_fetch(), the version 1 response parser reads a server-controlled comment_len value and advances the parse pointer without verifying sufficient bytes remain in the buffer, causing the out-of-bounds read to leak heap pointers from adjacent allocations defeating ASLR, followed by heap allocator state corruption when the error cleanup path frees an uninitialized pointer from a non-zeroed realloc() region.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-125",
        "CWE-908"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66034.json"
}
References

Affected packages

Git / github.com/libssh2/libssh2

Affected ranges

Type
GIT
Repo
https://github.com/libssh2/libssh2
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
a13bb6c773f0d55ad1628cede57e99803cd898d9
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:libssh2:libssh2:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "1.11.1"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "range":  [
                {
                    "fixed":  "a13bb6c773f0d55ad1628cede57e99803cd898d9"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

RELEASE.*
RELEASE.0.1
RELEASE.0.10
RELEASE.0.11
RELEASE.0.12
RELEASE.0.13
RELEASE.0.14
RELEASE.0.15
RELEASE.0.16
RELEASE.0.17
RELEASE.0.18
RELEASE.0.3
RELEASE.0.5
RELEASE.0.6
RELEASE.0.7
RELEASE.0.8
RELEASE.1.0
RELEASE.1.1
beforenb-0.*
beforenb-0.14
beforenb2-0.*
beforenb2-0.14
libssh2-1.*
libssh2-1.10.0
libssh2-1.11.0
libssh2-1.11.1
libssh2-1.2
libssh2-1.2.1
libssh2-1.2.3
libssh2-1.2.4
libssh2-1.2.5
libssh2-1.2.6
libssh2-1.2.7
libssh2-1.2.8
libssh2-1.2.9
libssh2-1.3.0
libssh2-1.4.0
libssh2-1.4.1
libssh2-1.4.2
libssh2-1.4.3
libssh2-1.5.0
libssh2-1.6.0
libssh2-1.7.0
libssh2-1.8.0
libssh2-1.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-66034.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "198481373953367669992453397832490020519",
                "66084080692611109197706311857865589381",
                "134017591480821814493369121025966465961",
                "128392399449835096795509536162118460613"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-66034-206f3d26",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/libssh2/libssh2/commit/a13bb6c773f0d55ad1628cede57e99803cd898d9",
        "target":  {
            "file":  "src/publickey.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "211152041484863357591819924214302562789",
            "length":  9907
        },
        "id":  "CVE-2026-66034-c7cfc643",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/libssh2/libssh2/commit/a13bb6c773f0d55ad1628cede57e99803cd898d9",
        "target":  {
            "file":  "src/publickey.c",
            "function":  "libssh2_publickey_list_fetch"
        }
    }
]
vanir_signatures_modified 
"2026-10-21T10:35:54Z"