CVE-2026-66033: Libssh2 Integer Underflow DoS Vulnerability

CVE-2026-66033 Overview

CVE-2026-66033 is a pre-authentication integer underflow vulnerability in libssh2 through version 1.11.1. The flaw resides in the ssh2_cipher_crypt() function within src/openssl.c and is triggered during Secure Shell (SSH) handshake when Advanced Encryption Standard Galois/Counter Mode (AES-GCM) ciphers are negotiated. A malicious SSH server can force any connecting client to crash before authentication completes. The issue was fixed in commit a2ed82d.

Critical Impact

Any application linking libssh2 as an SSH client can be crashed by a hostile server through cipher negotiation alone, resulting in denial of service without any credentials or user interaction.

Affected Products

• libssh2 versions up to and including 1.11.1
• Applications, tooling, and language bindings that statically or dynamically link libssh2 as an SSH client library
• Downstream distributions shipping libssh2 prior to the a2ed82d fix commit

Discovery Timeline

• 2026-07-24 - CVE-2026-66033 published to the National Vulnerability Database (NVD)
• 2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-66033

Vulnerability Analysis

The vulnerability is an integer underflow leading to an out-of-bounds read [CWE-125] in the AES-GCM cipher path of libssh2. During the SSH transport layer handshake, when the client negotiates an AES-GCM cipher, ssh2_cipher_crypt() computes the plaintext length by subtracting the additional authenticated data length (aadlen) and the authentication tag length from the block size. A malicious server can advertise parameters that make this subtraction underflow an unsigned width.

The underflowed value, close to SIZE_MAX, is then passed as the length argument to memcpy, causing an immediate out-of-bounds read and a process crash. Because the crash occurs during handshake, the client never reaches authentication, so exploitation requires no credentials and no user interaction beyond initiating an SSH connection. Impact is limited to availability of the client process; there is no memory corruption path enabling code execution described in the advisory.

Root Cause

The root cause is missing bounds validation before performing arithmetic on attacker-influenced integer values. The original code declared cryptlen as const int and relied on an assert(cryptlen >= 0) that is compiled out in release builds. When blocksize was smaller than aadlen + authenticationtag, the subtraction wrapped, producing a very large unsigned value used as a copy length.

Attack Vector

Exploitation is network-based and pre-authentication. An attacker operating or impersonating an SSH server responds to a client connection with a Key Exchange Init (SSH_MSG_KEXINIT) that negotiates an AES-GCM cipher, then sends crafted transport-layer data whose blocksize and tag length parameters trigger the underflow inside ssh2_cipher_crypt(). The victim client process crashes before any credential exchange.

     const int aadlen = (is_aesgcm && IS_FIRST(firstlast)) ? 4 : 0;
     /* size of AT, if present */
     const int authenticationtag = IS_LAST(firstlast) ? authlen : 0;
-    /* length to encrypt */
-    const int cryptlen = (unsigned int)blocksize - aadlen - authenticationtag;
+    unsigned int cryptlen; /* length to encrypt */
 
     (void)algo;
 
-    assert(blocksize <= sizeof(buf));
-    assert(cryptlen >= 0);
+    if(blocksize > sizeof(buf) ||
+       blocksize < (size_t)(aadlen + authenticationtag))
+        return 1;
+
+    cryptlen = (unsigned int)blocksize - aadlen - authenticationtag;
 
 #if LIBSSH2_AES_GCM
     /* First block */

Source: libssh2 commit a2ed82d. The patch replaces the release-time assert with an explicit runtime check that rejects invalid block sizes before the subtraction executes.

Detection Methods for CVE-2026-66033

Indicators of Compromise

• Repeated abnormal terminations or segmentation faults in processes that link libssh2, such as git, curl, backup agents, or SSH-based file transfer tools
• Client-side SSH sessions terminating immediately after SSH_MSG_KEXINIT and before SSH_MSG_SERVICE_REQUEST
• Outbound SSH connections to untrusted or newly observed servers that consistently correlate with client process crashes

Detection Strategies

• Inventory installed libssh2 versions across endpoints and servers using package managers and software bill of materials (SBOM) tooling, and flag any version at or below 1.11.1
• Correlate application crash telemetry with recent outbound TCP/22 connections to identify handshake-time failures consistent with this flaw
• Inspect SSH negotiation logs where verbose client logging is available to identify AES-GCM cipher selection followed by immediate disconnect

Monitoring Recommendations

• Track outbound SSH connections from CI/CD runners, developer workstations, and automation hosts to non-corporate destinations
• Alert on unexpected process exits for common libssh2 consumers such as git-remote-http, curl, and rsync wrappers
• Ingest endpoint crash reports and SSH client logs into a central data lake to enable retrospective hunting for handshake-stage failures

How to Mitigate CVE-2026-66033

Immediate Actions Required

• Upgrade libssh2 to a version containing commit a2ed82d or later and rebuild or repackage any statically linked consumers
• Apply vendor updates from Linux distributions and third-party software suppliers that bundle libssh2
• Restrict outbound SSH connectivity from sensitive systems to a curated list of trusted server endpoints until patching is complete

Patch Information

The upstream fix is available in the libssh2 commit a2ed82d and was merged via libssh2 pull request #2401. Additional analysis is published in the VulnCheck security advisory. The patch adds an explicit guard that returns an error when blocksize exceeds the internal buffer or is smaller than the combined aadlen and authentication tag length.

Workarounds

• Where the SSH client permits cipher configuration, remove AES-GCM ciphers (aes128-gcm@openssh.com, aes256-gcm@openssh.com) from the client-side allow list until the update is deployed
• Route SSH traffic through a hardened bastion host so untrusted servers cannot terminate handshakes directly against libssh2-linked clients
• Isolate automation systems that dial arbitrary SSH endpoints into segmented networks with egress filtering

# Verify installed libssh2 version and rebuild consumers after patching
ldconfig -p | grep libssh2
pkg-config --modversion libssh2

# Example: enforce a client cipher list that excludes AES-GCM until patched
# (applies to tools that honor an SSH cipher preference environment variable)
export LIBSSH2_CIPHERS="aes256-ctr,aes128-ctr"