ECHO-DAFD-2EC3-4DF0 Multiplication overflow in libssh2_publickey_list_fetch(): an attacker-controlled 32-bit num_attrs is multiplied by sizeof(libssh2_publickey_attribute) in the allocation without bounds checking. Per the CVE description and Debian tracker, the multiplication only overflows "on 32-bit platforms". Echo builds libssh2 exclusively for amd64/arm64, where size_t is 64-bit and the product of a 32-bit count cannot overflow, so the vulnerable code path is not reachable on any shipped architecture. Debian status: undetermined (no fixed version). Upstream fix 344975259 caps num_attrs at 1024; not backported — it does not apply to 1.11.1 (macro-namespace refactor) and is unnecessary on the 64-bit architectures we ship. https://security-tracker.debian.org/tracker/CVE-2026-58050