Linux Distros Unpatched Vulnerability : CVE-2026-58050

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation numattrs...

Linux Distros Unpatched Vulnerability : CVE-2026-58051

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libssh2 through 1.11.1 grows its publickey list with SSH2REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure...

libssh2 - Heap Buffer Over-read via sftp_symlink() in sftp.c

...

libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c

...

libssh2 - Pre-Authentication DoS via SSH_MSG_EXT_INFO Handler

...

PT-2026-53082

Name of the Vulnerable Software and Affected Versions libssh2 versions prior to 1.11.2 Description An integer overflow occurs when the software reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response. This value is used in the allocation num attrs sizeoflibssh2...

CVE-2026-55200 affecting package libssh2 for versions less than 1.11.1-3

CVE-2026-55200 affecting package libssh2 for versions less than 1.11.1-3. A patched version of the package is available...

curl: ssh_config_matches is dead code: unauthorized SSH key reuse

Summary libcurl's SSH connection-reuse guard sshconfigmatches — added for CVE-2022-27782 and reaffirmed by CVE-2023-27538 — is dead code in every release since 7.83.1. It compares sshc-rsa / sshc-rsapub between a new transfer "needle" and a pooled connection, but on both sides those pointers are...

PT-2026-53083

Name of the Vulnerable Software and Affected Versions libssh2 versions prior to 1.11.2 Description An issue exists in the public key parsing process where the software expands its public key list using SSH2 REALLOC but fails to zero-initialize new entries before they are populated. If a parse...

Debian dsa-6365 : libssh2-1-dev - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6365 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6365-1 [email protected] https://www.debian.org/securit...

libssh2-1-1.11.1-3.1 on GA media (moderate)

libssh2-1-1.11.1-3.1 on GA media Announcement ID: openSUSE-SU-2026:11109-1 Rating: moderate Cross-References: CVE-2025-15661 CVE-2026-55199 CVE-2026-55200 CVE-2026-7598 CVSS scores: CVE-2025-15661 SUSE : 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H CVE-2026-55199 SUSE : 5.9...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: libssh2: libssh2-1.11.1-9.hum1 aarch64, x8664 libssh2-devel-1.11.1-9.hum1 aarch64, x8664 libssh2-docs-1.11.1-9.hum1 noarch libssh2-1.11.1-9.hum1.src src...

libssh2: libssh2: Information disclosure and denial of service via crafted SFTP response

A flaw in libssh2's sftpsymlink function allows a malicious SSH server or man-in-the-middle attacker to trigger an out-of-bounds heap read via a crafted SSHFXPNAME response. This can disclose heap memory contents or crash the application, causing a denial of service DoS...

[SECURITY] [DSA 6365-1] libssh2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6365-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff June 25, 2026 https://www.debian.org/security/faq -...

libssh2: libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c

An out-of-bounds write vulnerability exists in the libssh2 client. A remote attacker can exploit this by sending a specially crafted SSH packet with an abnormally large length value. This corrupts the application's memory and can potentially allow the attacker to execute arbitrary code on the...

libssh2: libssh2: Denial of Service via crafted SSH_MSG_EXT_INFO message

A vulnerability in libssh2 allows a malicious SSH server to freeze connected clients during the handshake process. By sending a malformed packet, the server triggers a loop that exhausts the client's CPU, resulting in a denial of service...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: libssh2: libssh2-1.11.1-8.hum1 aarch64, x8664 libssh2-devel-1.11.1-8.hum1 aarch64, x8664 libssh2-docs-1.11.1-8.hum1 noarch libssh2-1.11.1-8.hum1.src src...

OPENSUSE-SU-2026:21057-1 Security update for libssh2_org

This update for libssh2org fixes the following issues - CVE-2026-55199: pre-Authentication DoS via SSHMSGEXTINFO Handler bsc1268530. - CVE-2026-55200: out-of-Bounds write via Unchecked packetlength in transport.c bsc1268531...

SUSE-SU-2026:22284-1 Security update for libssh2_org

This update for libssh2org fixes the following issues - CVE-2026-55199: pre-Authentication DoS via SSHMSGEXTINFO Handler bsc1268530. - CVE-2026-55200: out-of-Bounds write via Unchecked packetlength in transport.c bsc1268531...

The vulnerabilities in libssh2 are addressed through libssh.

LibSSH has vulnerabilities in libssh2, including versions up to 1.11.1. The first vulnerability involves a denial-of-service attack during the pre-authentication phase, within the SSHMSGEXTINFO handler. A malicious SSH server can send a specially constructed extensioncount value, causing the clie...