| Package | libssh2 |
|---|---|
| Version | 1.7.0-1+deb9u4 (stretch), 1.8.0-2.1+deb10u2 (buster) |
| Related CVEs | CVE-2025-15661 CVE-2026-7598 CVE-2026-58051 CVE-2026-66032 CVE-2026-66034 |
Multiple security vulnerabilities were discovered in libssh2, a client-side C library implementing the SSH2 protocol which could result in memory disclosure, denial of service or potentially the execution of arbitrary code.
CVE-2025-15661
A malicious server could send an oversized link_len in SSH_FXP_NAME
responses (READLINK/REALPATH) and trigger an out-of-bounds memcpy, leaking
heap memory or crashing the client
CVE-2026-7598
The impacted element is the function userauth_password of the file
src/userauth.c. Such manipulation of the argument
CVE-2026-58051
libssh2 grows its publickey list with SSH2_REALLOC but does not
zero-initialize new entries before parsing populates them, so a parse
failure reaching the cleanup path leaves. A malicious SSH server offering
the publickey subsystem can use a malformed response to make cleanup free an
uninitialized, attacker-influenceable attrs pointer in a connecting libssh2
client.
CVE-2026-66032
Fix double free in sftp_open() reachable from a malicious server during SFTP
session setup (SSH_FXP_OPEN answered with SSH_FXP_STATUS/FX_OK followed by a
failing sftp_packet_require()) (Closes:
CVE-2026-66034
Fix missing bounds check in libssh2_publickey_list_fetch() leading to a heap
out-of-bounds read and a free of an uninitialized pointer, triggerable by a
malicious server via the publickey subsystem.
For Debian 10 buster, these problems have been fixed in version 1.8.0-2.1+deb10u2.
For Debian 9 stretch, these problems have been fixed in version 1.7.0-1+deb9u4.
We recommend that you upgrade your libssh2 packages.
Further information about Extended LTS security advisories can be found in the dedicated section of our website.