CVE-2026-66035 libssh2 Heap Buffer Overflow via ETM Cipher Negotiation
HighCVSS 7.7
EPSS 0.47%
- Published
- Updated
- Exploit status
- No public exploit known
Description
libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packet_length smaller than the cipher's block size during Encrypt-then-MAC cipher negotiation. In the fullpacket() function in src/transport.c, the ETM path allocates a buffer of packet_length bytes but copies blocksize minus one bytes via memcpy, causing an overflow that on 32-bit glibc writes attacker-controlled bytes into an adjacent chunk's SIZE field, enabling tcache bin confusion, overlapping live objects, and function pointer overwrite during the session handshake before authentication.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| azure linux libssh2(Azure Linux:3.0) | < 1.11.1-5 | 1.11.1-5 |
| libssh2 | <= 1.11.1 | No fix listed |
| redhat/libssh2-main(Red Hat:hummingbird:1) | < 1.11.1-10.3.hum1 | 1.11.1-10.3.hum1 |
| redhat/libssh2(Red Hat:rhel_els:6) | All versions | No fix listed |
| debian/libssh2(Debian:13) | < 1.11.1-1+deb13u2 | 1.11.1-1+deb13u2 |
| debian/libssh2(Debian:13) | = 1.11.1-1 | No fix listed |
| debian/libssh2(Debian:13) | = 1.11.1-1+deb13u1 | No fix listed |
| debian/libssh2(Debian:14) | < 1.11.1-5 | 1.11.1-5 |
| debian/libssh2(Debian:14) | = 1.11.1-1 | No fix listed |
| debian/libssh2(Debian:14) | = 1.11.1-2 | No fix listed |
| debian/libssh2(Debian:14) | = 1.11.1-3 | No fix listed |
| debian/libssh2(Debian:14) | = 1.11.1-4 | No fix listed |
| ubuntu/libssh2(Ubuntu:22.04) | All versions | No fix listed |
| alpine/libssh2(Alpine:v3.21) | < 1.11.1-r3 | 1.11.1-r3 |
| alpine/libssh2(Alpine:v3.22) | < 1.11.1-r3 | 1.11.1-r3 |
| alpine/libssh2(Alpine:v3.23) | < 1.11.1-r4 | 1.11.1-r4 |
| alpine/libssh2(Alpine:v3.24) | < 1.11.1-r4 | 1.11.1-r4 |
| ubuntu/libssh2(Ubuntu:24.04) | < 1.11.0-4.1ubuntu0.24.04.4 | 1.11.0-4.1ubuntu0.24.04.4 |
| ubuntu/libssh2(Ubuntu:26.04) | < 1.11.1-1ubuntu0.26.04.4 | 1.11.1-1ubuntu0.26.04.4 |
References
- MSRC Security Update Guide vendor-advisory
- CBL-Mariner Releases vendor-advisory
- Pull Request issue-tracking patch
- Patch Commit patch
- www.vulncheck.com patch third-party-advisory
- Red Hat CVE page mitigation vendor-advisory
- RHSA-2026:46955 patch vendor-advisory
- Red Hat Bugzilla 2506851 issue-tracking
- www.cve.org
- nvd.nist.gov
- Debian Security Tracker CVE-2026-66035 vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- USN-8722-1 vendor-advisory
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking