CVE-2026-66034: Libssh2 Buffer Overflow Vulnerability

CVE-2026-66034 Overview

CVE-2026-66034 is a missing bounds check vulnerability in libssh2 through version 1.11.1, fixed in commit a13bb6c. A malicious SSH server can trigger an arbitrary-length heap out-of-bounds read and a free of an uninitialized pointer through the publickey subsystem. The flaw resides in libssh2_publickey_list_fetch(), where the version 1 response parser reads a server-controlled comment_len value without validating remaining buffer bytes. Successful exploitation leaks heap pointers from adjacent allocations, defeating Address Space Layout Randomization (ASLR), and corrupts heap allocator state through the error cleanup path.

Critical Impact
A hostile SSH server can bypass ASLR and corrupt heap state on any client using libssh2's publickey subsystem, enabling reliable follow-on memory-corruption exploitation.

Affected Products

libssh2 versions through 1.11.1
Applications embedding libssh2 for SSH client functionality
Distributions shipping unpatched libssh2 packages

Discovery Timeline

2026-07-24 - CVE-2026-66034 published to the National Vulnerability Database (NVD)
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-66034

Vulnerability Analysis

The defect lives in libssh2_publickey_list_fetch() within src/publickey.c. When parsing a version 1 publickey subsystem response, the function reads a length-prefixed comment field. The parser advances pkey->listFetch_s by comment_len bytes without confirming those bytes remain inside the allocated response buffer. Because comment_len is fully attacker controlled, the read can extend arbitrarily past the buffer end.

The out-of-bounds read discloses adjacent heap memory, which typically contains pointers useful for defeating ASLR. Compounding the impact, the subsequent error cleanup path can call free() on a pointer that resides inside a realloc() region that was never zero-initialized, corrupting allocator metadata. This condition is classified under [CWE-125] Out-of-Bounds Read.

Root Cause

The root cause is missing length validation before pointer arithmetic on network-supplied data. The parser trusts comment_len sent by the server and does not compare pkey->listFetch_s + comment_len against the end of the response buffer pkey->listFetch_data + pkey->listFetch_data_len before continuing to process fields.

Attack Vector

Exploitation requires a victim client to initiate an SSH connection to a server the attacker controls, or a machine-in-the-middle position that can substitute publickey subsystem responses. The user must be persuaded to connect, so exploitation is not fully unauthenticated in the operational sense. Once connected, the malicious server sends a crafted publickey list response with an oversized comment_len to trigger the read and subsequent free.

                 }
 
                 if(comment_len) {
+                    if(pkey->listFetch_s + comment_len >
+                       pkey->listFetch_data + pkey->listFetch_data_len) {
+                        ssh2_err(session, LIBSSH2_ERROR_BUFFER_TOO_SMALL,
+                                 "ListFetch data too short");
+                        goto err_exit;
+                    }
+
                     list[keys].num_attrs = 1;
                     list[keys].attrs =
                         SSH2_ALLOC(session,

Source: GitHub commit a13bb6c. The patch adds an explicit bounds check that aborts parsing with LIBSSH2_ERROR_BUFFER_TOO_SMALL before the vulnerable pointer arithmetic executes.

Detection Methods for CVE-2026-66034

Indicators of Compromise

Client processes linking libssh2.so versions at or below 1.11.1 initiating outbound SSH sessions to untrusted hosts
SSH client crashes, aborts, or heap corruption warnings following connections that invoke the publickey subsystem
Unexpected outbound SSH connections from build agents, package managers, or automation tools to attacker-controlled endpoints

Detection Strategies

Inventory installed libssh2 versions across endpoints and containers, flagging any build at or below 1.11.1
Monitor process telemetry for SSH client crashes correlated with publickey authentication attempts
Inspect SSH traffic for publickey subsystem responses containing abnormally large comment length fields

Monitoring Recommendations

Alert on new outbound SSH sessions from CI/CD systems, package fetchers, and Git clients to unknown IP space
Correlate crash events in processes that load libssh2 with recent network activity for triage
Track software bill of materials (SBOM) updates to confirm patched libssh2 is deployed across dependent applications

How to Mitigate CVE-2026-66034

Immediate Actions Required

Update libssh2 to a release that includes commit a13bb6c or later and rebuild any statically linked consumers
Audit applications that embed libssh2, including package managers, Git clients, and automation tooling, and patch each dependency chain
Restrict outbound SSH connectivity from servers and build systems to a known-good allowlist while patching proceeds

Patch Information

The fix is committed upstream in libssh2 commit a13bb6c and tracked in pull request #2202. Additional analysis is available in the VulnCheck advisory. Rebuild and redeploy every application that statically links libssh2 after upgrading, since dynamic library replacement alone will not remediate static consumers.

Workarounds

Avoid using the publickey subsystem where feasible until the patched library is deployed
Restrict SSH client connections to servers under organizational control to reduce exposure to hostile server responses
Enforce strict egress filtering on hosts running SSH automation so clients cannot reach arbitrary internet endpoints

bash

# Verify installed libssh2 version and check for the patched commit
ldconfig -p | grep libssh2
pkg-config --modversion libssh2
# On Debian/Ubuntu
apt list --installed 2>/dev/null | grep libssh2
# On RHEL/Fedora
rpm -q libssh2