DEBIAN-CVE-2026-66034

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-66034
Import Source
https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-66034.json
JSON Data
https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2026-66034
Upstream
Published
2026-07-24T17:17:35Z
Modified
2026-10-06T10:06:24Z
Summary
[none]
Details

libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of an uninitialized pointer via the publickey subsystem. In libssh2_publickey_list_fetch(), the version 1 response parser reads a server-controlled comment_len value and advances the parse pointer without verifying sufficient bytes remain in the buffer, causing the out-of-bounds read to leak heap pointers from adjacent allocations defeating ASLR, followed by heap allocator state corruption when the error cleanup path frees an uninitialized pointer from a non-zeroed realloc() region.

References

Affected packages

Debian:12 / libssh2

Package

Name
libssh2
Purl
pkg:deb/debian/libssh2?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.10.0-3+deb12u1

Affected versions

1.*
1.10.0-3

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-66034.json"

Debian:13 / libssh2

Package

Name
libssh2
Purl
pkg:deb/debian/libssh2?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.11.1-1+deb13u2

Affected versions

1.*
1.11.1-1
1.11.1-1+deb13u1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-66034.json"

Debian:14 / libssh2

Package

Name
libssh2
Purl
pkg:deb/debian/libssh2?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.11.1-5

Affected versions

1.*
1.11.1-1
1.11.1-2
1.11.1-3
1.11.1-4

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-66034.json"