Libssh: libssh: denial of service via sftp responses with unknown request ids

...

Security Bulletin: Multiple Vulnerabilities in IBM Operator for PostgreSQL

Summary Multiple vulnerabilities were addressed in IBM Operator for PostgreSQL version v28.4.1. Vulnerability Details CVEID:CVE-2026-39830 DESCRIPTION: A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked...

frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow

Summary An integer-overflow vulnerability in the frp server's optional SSH Tunnel Gateway lets any unauthenticated remote attacker crash the entire frps process with a single five-byte message. When the gateway parses an SSH exec channel request in pkg/ssh/server.go, it adds a small constant to a...

GHSA-26GQ-P25F-99CP frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow

Summary An integer-overflow vulnerability in the frp server's optional SSH Tunnel Gateway lets any unauthenticated remote attacker crash the entire frps process with a single five-byte message. When the gateway parses an SSH exec channel request in pkg/ssh/server.go, it adds a small constant to a...

AZL-93393 CVE-2026-66034 affecting package libssh2 for versions less than 1.11.1-5

libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of an uninitialized pointer via the publickey subsystem. In libssh2publickeylistfetch, the version 1...

AZL-93396 CVE-2026-66032 affecting package libssh2 for versions less than 1.11.1-5

libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftpopen function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSHFXPOPEN with SSHFXPSTATUS containin...

CVE-2026-66035

libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packetlength smaller than the cipher's block size during Encrypt-then-M...

DEBIAN-CVE-2026-66032

libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftpopen function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSHFXPOPEN with SSHFXPSTATUS containin...

assistant_daemon (0.1.0), async-ssh2-tokio (>=0.2.0, <=0.8.11) +7 more potentially affected by CVE-2026-73429 via russh (>=0.34.0, <=0.43.0)

russh CARGO version =0.34.0, =0.2.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.4.1 - sshrpc 0.1.0 - tunnels 0.1.0 Source cves: CVE-2026-73429 Source advisory: OSV:GHSA-G9HV-X236-4QP3...

assistant_daemon (0.1.0), async-ssh2-tokio (>=0.2.0, <=0.8.11) +7 more potentially affected by CVE-2026-73430 via russh (>=0.34.0, <=0.43.0)

russh CARGO version =0.34.0, =0.2.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.4.1 - sshrpc 0.1.0 - tunnels 0.1.0 Source cves: CVE-2026-73430 Source advisory: OSV:GHSA-5XVQ-CP9X-6P6R...

CVE-2026-66035 libssh2 Heap Buffer Overflow via ETM Cipher Negotiation

libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packetlength smaller than the cipher's block size during Encrypt-then-M...

EUVD-2026-48720

libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2ciphercrypt function in src/openssl.c that allows a malicious SSH server to crash any connecting client by negotiating AES-GCM ciphers during handshake. Attackers can exploit...

CVE-2026-66032

libssh2

MAL-2026-11049 Malicious code in mrmustard (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 535679eb30bfd0600dc07e44d2e649c88ecb6274364e2ba0b1ef2ccc05976727 On plain import mrmustard, the top-level init.py spawns a background thread that reads /.ssh/ private keys, /.aws/credentials, /.aws/config,...

Exploit for Missing Authentication for Critical Function in Erlang Erlang\/Otp

CVE-2025-32433: Erlang/OTP SSH Daemon Pre-Auth Remote Code Exe...

Apache MINA SSHD input validation error vulnerability

Apache MINA SSHD is a Java library for client-side and server-side SSH communication. The sshd-git component of Apache MINA SSHD has a vulnerability related to input validation errors. This vulnerability arises from GitPgmCommandFactory failing to properly validate the git commands entered by...

CVE-2026-65698

The CVE-2026-65698 entry describes a path traversal vulnerability in Void 1.3.4’s AI agent file-reading tools. The read_file, ls_dir, get_dir_tree, and search_* tools allow network-adjacent attackers to inject instructions and read arbitrary host files outside the open workspace, bypassing worksp...

JLSEC-2026-778

A flaw was found in libssh. This vulnerability allows local man-in-the-middle attacks, security downgrades of SSH Secure Shell connections, and manipulation of trusted host information, posing a significant risk to the confidentiality, integrity, and availability of SSH communications via an...

[SECURITY] Fedora 44 Update: libssh-0.12.1-1.fc44

The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, trans fer files, use a secure and transparent tunnel for your remote...

MAL-2026-11002 Malicious code in habinger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56e193021af7a2102362115c0e0f4564f90f3cf86a4e867b6f02ce266ba419e5 The package's postinstall hook package.json postinstall: node test.js auto-executes two malicious flows on npm install. First, on Linux it fetches an...