CVE-2026-66035: Libssh2 Buffer Overflow Vulnerability

CVE-2026-66035 Overview

CVE-2026-66035 is a pre-authentication heap buffer overflow in libssh2 through version 1.11.1, tracked as [CWE-122]. A malicious Secure Shell (SSH) server can corrupt heap metadata in any connecting client by sending a packet with a packet_length smaller than the cipher's block size during Encrypt-then-MAC (ETM) cipher negotiation. The flaw resides in the fullpacket() function in src/transport.c, where the ETM decrypt path allocates a buffer sized by attacker-controlled input but writes blocksize - 1 bytes into it. The condition triggers before authentication completes, giving an unauthenticated remote attacker a path to memory corruption in the client process.

Critical Impact
A hostile SSH server can corrupt heap metadata in libssh2 clients before authentication, enabling tcache bin confusion, overlapping live objects, and function pointer overwrite during the session handshake.

Affected Products

libssh2 through version 1.11.1
Applications and clients statically or dynamically linked against vulnerable libssh2 builds
Fixed in commit 42e33d8

Discovery Timeline

2026-07-24 - CVE-2026-66035 published to the National Vulnerability Database (NVD)
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-66035

Vulnerability Analysis

The defect is a classic heap buffer overflow reachable during SSH transport-layer decryption. When ETM ciphers are negotiated, libssh2 reads a 4-byte plaintext packet_length field from the server before decrypting the remainder of the packet. The client allocates a payload buffer sized to packet_length, then copies the first cipher block into that buffer for in-place decryption. When packet_length is smaller than the cipher block size, the copy operation writes past the end of the undersized allocation. On 32-bit glibc, the overflow lands in the adjacent chunk's SIZE field, which corrupts tcache metadata and enables heap layout manipulation. The result is overlapping live allocations and, ultimately, control-flow hijack through function pointer overwrite while the handshake is still running.

Root Cause

The root cause is missing input validation on the server-supplied packet_length value in the ETM decrypt path of fullpacket(). The allocation size is trusted from the wire, while the copy length is fixed at blocksize - 1. When packet_length < blocksize, the write outruns the allocation. No authentication is required to reach this code path because it runs during the transport layer handshake.

Attack Vector

Exploitation requires the victim to connect to an attacker-controlled or attacker-influenced SSH server. This can occur through phishing links, malicious Git remotes, compromised CI/CD runners, DNS redirection, or man-in-the-middle interception of legitimate SSH traffic. The malicious server responds during cipher negotiation with a crafted ETM packet whose packet_length field is set below the negotiated block size, triggering the overflow in the client.

                 unsigned char *decrypt_buffer;
                 int blocksize = session->remote.crypt->blocksize;
 
+                if(p->total_num < mac_len + 4 + (size_t)blocksize) {
+                    SSH2_SAFEFREE(session, p->payload);
+                    return LIBSSH2_ERROR_DECRYPT;
+                }
+                decrypt_size = (ssize_t)(p->total_num - mac_len - 4);
+
                 first_block[0] = 0;
 
                 rc = transport_decrypt(session, p->payload + 4,

Source: libssh2 commit 42e33d8. The patch adds a bounds check ensuring p->total_num is at least mac_len + 4 + blocksize before proceeding with ETM decryption. If the check fails, the payload is freed and the transport returns LIBSSH2_ERROR_DECRYPT, preventing the undersized allocation from being written past its end.

Detection Methods for CVE-2026-66035

Indicators of Compromise

Outbound SSH connections from workstations, build agents, or servers to unexpected destinations followed by client process crashes or aborts.
libssh2-linked processes (for example git, curl, rsync wrappers, backup agents) terminating with SIGSEGV or glibc heap corruption messages such as malloc(): unaligned tcache chunk detected.
SSH sessions closed immediately after the KEXINIT and cipher negotiation phase without reaching authentication.

Detection Strategies

Inventory all binaries linking against libssh2 and flag versions at or below 1.11.1 for follow-up patching.
Inspect SSH transport packet captures for ETM cipher negotiations where the first encrypted packet_length field is smaller than the negotiated block size.
Correlate libssh2 client crashes with the remote peer address to identify potentially hostile SSH endpoints.

Monitoring Recommendations

Alert on repeated client-side aborts of libssh2-based tooling connecting to the same remote host.
Monitor egress SSH traffic from CI/CD runners and developer workstations to unapproved destinations.
Ingest process crash telemetry and glibc heap diagnostics into a centralized data lake for correlation across endpoints.

How to Mitigate CVE-2026-66035

Immediate Actions Required

Upgrade libssh2 to a build that includes commit 42e33d8 and rebuild or repackage all dependent applications.
Audit third-party software and language bindings (Python, Rust, PHP, Ruby) that bundle their own copy of libssh2 and update those copies.
Restrict outbound SSH from endpoints and build infrastructure to an allowlist of known-good destinations until patched.

Patch Information

The fix is committed upstream at libssh2 commit 42e33d8 and tracked in libssh2 pull request #2198. Additional analysis is available in the VulnCheck Security Advisory. The patch adds a length validation that rejects ETM packets whose total size cannot accommodate the MAC, length prefix, and one full cipher block.

Workarounds

Disable ETM ciphers in client configuration where the SSH client exposes cipher selection, forcing negotiation onto non-ETM modes until patches are deployed.
Route SSH traffic through a hardened jump host or SSH-aware proxy that terminates and re-originates sessions, preventing direct client exposure to untrusted servers.
Constrain the use of libssh2-based tooling to trusted remote hosts through network segmentation and egress filtering.

bash

# Verify installed libssh2 version and locate linked binaries
ldconfig -p | grep libssh2
libssh2_version=$(pkg-config --modversion libssh2 2>/dev/null)
echo "Detected libssh2 version: ${libssh2_version}"

# Identify running processes linked against libssh2
lsof 2>/dev/null | grep -i libssh2 | awk '{print $1, $2}' | sort -u