CVE-2026-66033

libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2ciphercrypt function in src/openssl.c that allows a malicious SSH server to crash any connecting client by negotiating AES-GCM ciphers during handshake. Attackers can exploit...

EUVD-2026-48720

libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2ciphercrypt function in src/openssl.c that allows a malicious SSH server to crash any connecting client by negotiating AES-GCM ciphers during handshake. Attackers can exploit...

CVE-2026-66033

CVE-2026-66033 affects libssh2 up to 1.11.1. A pre-authentication integer underflow in the ssh2_cipher_crypt() function (src/openssl.c) allows a malicious SSH server to crash a connecting client during handshake by negotiating AES-GCM ciphers. The underflow (blocksize − aadlen − taglen) can trigg...