Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the fullpacket function during Encrypt-then-MAC cipher negotiation. An attacker can corrupt heap metadata and potentially achieve arbitrary code execution or cause a denial of service by sending a specially...

CVE-2026-66035 libssh2 Heap Buffer Overflow via ETM Cipher Negotiation

libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packetlength smaller than the cipher's block size during Encrypt-then-M...

CVE-2026-66035

libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packetlength smaller than the cipher's block size during Encrypt-then-M...

OSV-2024-847 Null-dereference READ in _libssh2_packet_add

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=69234 Crash type: Null-dereference READ Crash state: libssh2packetadd fullpacket libssh2transportread...

PT-2023-35661 · Libssh2 · Libssh2

Name of the Vulnerable Software and Affected Versions: libssh2 affected versions not specified Description: The issue is related to a heap buffer overflow read. Technical details about the crash include the libssh2 kex agree instr and libssh2 packet add functions, as well as the fullpacket state...