CentOS Linux 6 [TuxCare] Security Update: libssh2 / libssh2-devel / libssh2-docs (CENTOS6:CLSA-2026:1784282780)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1784282780 advisory. - libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation...

CVE-2026-93994 Apache MINA SSHD: Repeated-publickey policy bypass on server

Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshdconfig AuthenticationMethods "publickey,publickey"...

CVE-2026-93994 Apache MINA SSHD: Repeated-publickey policy bypass on server

Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshdconfig AuthenticationMethods "publickey,publickey"...

CVE-2026-93994

The Apache MINA SSHD Java library is affected by a partial authentication bypass in versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 . The vulnerability exists in the sshd-core component, where the server fails to enforce that two distinct public keys are used when a multi-authentication policy (e....

CVE-2026-94053

The Apache MINA SSHD Java library is vulnerable to an authentication bypass via LDAP injection within the optional sshd-ldap component. The root cause is a lack of proper escaping for LDAP filter metacharacters, which allows an attacker to successfully authenticate using the username "" and passw...

USN-8799-1 libssh2 vulnerabilities

It was discovered that libssh2 incorrectly handled certain publickey subsystem attributes. A remote attacker controlling a malicious SSH server could use this issue to cause a denial of service or possibly execute arbitrary code. CVE-2026-58050 It was discovered that libssh2 did not properly...

USN-8799-1: libssh2 vulnerabilities

It was discovered that libssh2 incorrectly handled certain publickey subsystem attributes. A remote attacker controlling a malicious SSH server could use this issue to cause a denial of service or possibly execute arbitrary code. CVE-2026-58050 It was discovered that libssh2 did not properly...

Ubuntu 14.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / Pro Realtime 22.04 LTS : libssh2 vulnerabilities (USN-8799-1)

The remote Ubuntu 14.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / Pro Realtime 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8799-1 advisory. It was discovered that libssh2 incorrectly handled certain publickey subsystem attributes. A...

EulerOS Virtualization 2.10.1 : libssh2 (EulerOS-SA-2026-3838)

According to the versions of the libssh2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the...

EulerOS Virtualization 2.10.0 : libssh2 (EulerOS-SA-2026-3872)

According to the versions of the libssh2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the...

EulerOS 2.0 SP10 : libssh2 (EulerOS-SA-2026-3749)

According to the versions of the libssh2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation...

EulerOS 2.0 SP10 : libssh2 (EulerOS-SA-2026-3701)

According to the versions of the libssh2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation...

EulerOS Virtualization 2.12.1 : libssh2 (EulerOS-SA-2026-3594)

According to the versions of the libssh2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the...

EulerOS Virtualization 2.12.0 : libssh2 (EulerOS-SA-2026-3648)

According to the versions of the libssh2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the...

ROS-20260907-73-0029

The vulnerability of the libssh2publickeylistFetch function in the libssh2 library is related to the use of uninitialized resources. Exploiting this vulnerability could allow a malicious actor to cause service failures...

libssh2: libssh2: Information disclosure and potential arbitrary code execution via heap out-of-bounds read

A missing bounds check in the libssh2 publickey subsystem allows malicious SSH servers to trigger a client-side out-of-bounds read, leaking heap pointers that could enable security bypasses, denial of service, or code execution...

libssh2: libssh2: Heap buffer overflow via integer overflow in publickey attribute allocation

A flaw in libssh2 allows a malicious SSH server to trigger a memory overflow by sending a manipulated attribute count. This can cause the connecting client to crash or allow unauthorized code execution...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libssh2 (UTSA-2026-102700)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102700 advisory. libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation numattrs...

CVE-2026-50192: Exposure of Sensitive Information to an Unauthorized Actor

Kerberos Agent is an open source video surveillance management agent. Prior to version 3.6.26, the Kerberos Hub upload path sends the agent's Hub credentials in the custom X-Kerberos-Hub-PrivateKey and X-Kerberos-Hub-PublicKey request headers to the operator-configured Hub URL config.HubURI. The...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libssh2 (UTSA-2026-102688)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102688 advisory. libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap...