ECHO-dafd-2ec3-4df0
See a problem?- Import Source
- https://advisory.echohq.com/osv/ECHO-dafd-2ec3-4df0.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/ECHO-dafd-2ec3-4df0
- Upstream
- Withdrawn
- 2026-07-15T08:15:03Z
- Published
- 2026-07-15T08:15:03Z
- Modified
- 2026-07-29T18:23:45Z
- Summary
- Multiplication overflow in libssh2_publickey_list_fetch(): an attacker-controlled 32-bit num_attrs is multiplied by sizeof(libssh2_publickey_attribute) in the allocation without bounds checking. Per the CVE description and Debian tracker, the multiplication only overflows "on 32-bit platforms". Echo builds libssh2 exclusively for amd64/arm64, where size_t is 64-bit and the product of a 32-bit count cannot overflow, so the vulnerable code path is not reachable on any shipped architecture. Debian status: undetermined (no fixed version). Upstream fix 344975259 caps num_attrs at 1024; not backported — it does not apply to 1.11.1 (macro-namespace refactor) and is unnecessary on the 64-bit architectures we ship. https://security-tracker.debian.org/tracker/CVE-2026-58050
- Details
- References