libssh2

A library implementing the SSH2 protocol

Current: 1.11.1
Candidate: Stale

License: BSD-3-Clause

Build

Target	Result	Last successful version	Succeeded at
rva23	Succeeded	1.11.1	2026-10-23 09:44:17 UTC
rva20	Succeeded	1.11.1	2026-10-23 10:54:30 UTC
x86_64	Succeeded	1.11.1	2026-10-23 09:31:56 UTC

Advisory · 10

Query product: libssh2NVD
Query vendor: libssh2NVD
Query version: 1.11.1NVD

Provider matches do not establish RPM applicability. Local patches, bundled dependencies and binary artifacts are not evaluated.

CVE-2025-15661
NVD
Summary
libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c that allows a malicious SSH server or man-in-the-middle attacker to disclose heap memory contents or cause a crash by sending a crafted SSH_FXP_NAME response. Attackers can supply a link_len value larger than the actual packet data in SSH_FXP_NAME responses for SFTP READLINK and REALPATH operations, triggering a heap buffer over-read of up to target_len minus one bytes due to the missing validation of available packet buffer size before the memcpy oper…NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.648%FIRST
Vulnerable CPE criteria
cpe:2.3:a:libssh2:libssh2:*:*:*:*:*:*:*:*; <= 1.11.1NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:HNVD
CVSS_V4
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XNVD
Summary characters omitted
6NVD
References
Fix · 2dae3024897e Fix · github.com Fix · github.com Web · cert-portal.siemens.com Web · www.vulncheck.com
CVE-2026-55199
NVD
Summary
libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can set nr_extensions to 0xFFFFFFFF during key exchange, causing the client to spin in a tight CPU loop for over 60 seconds because return values from _libssh2_get_string() are unchecked and the session timeout does not apply to CPU-bound loops.NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.918%FIRST
Vulnerable CPE criteria
cpe:2.3:a:libssh2:libssh2:*:*:*:*:*:*:*:*; <= 1.11.1NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HNVD
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HNVD
CVSS_V4
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XNVD
References
Fix · 17626857d20b Fix · github.com Web · www.vulncheck.com
CVE-2026-55200
NVD
Summary
libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.NVD
EPSS model date
2026-11-10FIRST
EPSS probability
3.88%FIRST
Vulnerable CPE criteria
cpe:2.3:a:libssh2:libssh2:1.11.1:*:*:*:*:*:*:*NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HNVD
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:LNVD
CVSS_V4
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XNVD
References
Fix · 97acf3dfda80 Fix · github.com Web · web.archive.org Web · www.vulncheck.com
CVE-2026-58050
NVD
Summary
libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation num_attrs * sizeof(libssh2_publickey_attribute) without bounds checking, so on 32-bit platforms the multiplication overflows to an undersized buffer. A malicious SSH server can then drive the attribute-parsing loop to write past the allocation, causing a heap buffer overflow in a connecting libssh2 client.NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.444%FIRST
Vulnerable CPE criteria
cpe:2.3:a:libssh2:libssh2:*:*:*:*:*:*:*:*; <= 1.11.1NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:HNVD
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HNVD
CVSS_V4
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XNVD
References
Web · github.com Web · github.com Web · www.vulncheck.com
CVE-2026-58051
NVD
Summary
libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2_publickey_list_free operating on an uninitialized entry. A malicious SSH server offering the publickey subsystem can use a malformed response to make cleanup free an uninitialized, attacker-influenceable attrs pointer in a connecting libssh2 client.NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.277%FIRST
Vulnerable CPE criteria
cpe:2.3:a:libssh2:libssh2:*:*:*:*:*:*:*:*; <= 1.11.1NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:HNVD
CVSS_V4
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XNVD
References
Web · cert-portal.siemens.com Web · github.com Web · github.com Web · www.vulncheck.com
CVE-2026-66032
NVD
Summary
libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSH_FXP_OPEN with SSH_FXP_STATUS containing FX_OK, the response data buffer is freed, and if a subsequent sftp_packet_require() call returns a specific error such as LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED, the same pointer is freed a second time, enabling tcache dup conditions on glibc systems that allow overlapping allocations and funct…NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.448%FIRST
Vulnerable CPE criteria
cpe:2.3:a:libssh2:libssh2:*:*:*:*:*:*:*:*; <= 1.11.1NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HNVD
CVSS_V4
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XNVD
Summary characters omitted
23NVD
References
Fix · 5e4776146552 Fix · github.com Fix · www.vulncheck.com Web · cert-portal.siemens.com
CVE-2026-66033
NVD
Summary
libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2_cipher_crypt() function in src/openssl.c that allows a malicious SSH server to crash any connecting client by negotiating AES-GCM ciphers during handshake. Attackers can exploit the underflow in the expression computing blocksize minus aadlen minus authentication tag length to trigger an out-of-bounds read and a memcpy call with a near-SIZE_MAX length argument, causing immediate process crash before any authentication occurs.NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.583%FIRST
Vulnerable CPE criteria
cpe:2.3:a:libssh2:libssh2:*:*:*:*:*:*:*:*; <= 1.11.1NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HNVD
CVSS_V4
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XNVD
References
Fix · a2ed82d40964 Fix · github.com Fix · www.vulncheck.com
CVE-2026-66034
NVD
Summary
libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of an uninitialized pointer via the publickey subsystem. In libssh2_publickey_list_fetch(), the version 1 response parser reads a server-controlled comment_len value and advances the parse pointer without verifying sufficient bytes remain in the buffer, causing the out-of-bounds read to leak heap pointers from adjacent allocations defeating ASLR, followed by heap allocator state corruption when the er…NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.402%FIRST
Vulnerable CPE criteria
cpe:2.3:a:libssh2:libssh2:*:*:*:*:*:*:*:*; <= 1.11.1NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HNVD
CVSS_V4
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XNVD
Summary characters omitted
83NVD
References
Fix · a13bb6c773f0 Fix · github.com Fix · www.vulncheck.com Web · cert-portal.siemens.com
CVE-2026-66035
NVD
Summary
libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packet_length smaller than the cipher's block size during Encrypt-then-MAC cipher negotiation. In the fullpacket() function in src/transport.c, the ETM path allocates a buffer of packet_length bytes but copies blocksize minus one bytes via memcpy, causing an overflow that on 32-bit glibc writes attacker-controlled bytes into an adjacent chunk's SIZE field, enabling tcache…NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.472%FIRST
Vulnerable CPE criteria
cpe:2.3:a:libssh2:libssh2:*:*:*:*:*:*:*:*; <= 1.11.1NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HNVD
CVSS_V4
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XNVD
Summary characters omitted
124NVD
References
Fix · 42e33d81577e Fix · github.com Fix · www.vulncheck.com
CVE-2026-7598
NVD
Summary
A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The name of the patch is 256d04b60d80bf1190e96b0ad1e91b2174d744b1. A patch should be applied to remediate this issue.NVD
EPSS model date
2026-11-10FIRST
EPSS probability
0.466%FIRST
Vulnerable CPE criteria
cpe:2.3:a:libssh2:libssh2:*:*:*:*:*:*:*:*; <= 1.11.1NVD
Aliases
—NVD
KEV
NoCISA
CVSS_V2
AV:N/AC:L/Au:N/C:P/I:P/A:PNVD
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LNVD
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HNVD
CVSS_V4
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XNVD
Additional references
1NVD
References
Fix · 256d04b60d80 Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · access.redhat.com Web · bugzilla.redhat.com Web · cert-portal.siemens.com Web · github.com Web · github.com Web · security.access.redhat.com Web · vuldb.com Web · vuldb.com

Description

libssh2 is a library implementing the SSH2 protocol. It supports authenticated key exchange, arbitrary channel communication, and a variety of SFTP and SCP operations.

Changelog

SPECS: libssh2: Add source checksums and use %autochangelog
Jingwiw0e9113d896172026-10-06 13:07:36 UTC
SPECS: libssh2: Fix spec file formatting.
misaka002512d878b87dd932026-01-26 14:41:43 UTC
SPECS: libssh2: fix tests.
yyjeqhce4aa916bdc052025-12-16 11:10:23 UTC
SPECS: libssh2: format.
yyjeqhc7debe19d7da42025-12-16 11:09:45 UTC
SPECS: Don't manually delete the la file.
Zheng Junjie5298531f80202025-12-01 11:32:48 UTC
SPECS: glibc: Auto call ldconfig.
Zheng Junjie24d6ed4da5ec2025-12-01 14:10:56 UTC
Initial commit
Z572bc722d18574a2025-08-05 09:00:05 UTC

PR · 2

#1401 Correct package metadata and source declaration (PART I)
Jingwiw2026-10-23 09:15:38 UTC
#104 SPECS: *: Fix style %{?autochangelog} -> %autochangelog (automated)
dramforever2026-04-09 06:15:39 UTC

Issue · 1

#1232 pre-commit: Add spec name check step to CI pipeline
redrose21002026-09-11 02:47:17 UTC

Checks

Monitor	Observation	Last checked
Source	Stale Repository refresh: git fetch exited 128 (authentication)	2026-11-10 17:23:44 UTC
Version	Stale Source last confirmed at 2026-11-10T17:23:44+00:00; repository refresh overdue.	2026-11-10 17:37:16 UTC
Build	Checked	2026-11-10 19:12:56 UTC
GitHub	Checked	2026-11-10 19:06:38 UTC
EOL	Not configured No reliable monitor identity/configuration.	—
LicenseDiff	Not configured No reliable monitor identity/configuration.	—
Dependencies	Not configured No reliable monitor identity/configuration.	—
Advisory	Checked Current source component only; local patches, build options, bundled dependencies and binary artifacts are not evaluated.	2026-11-10 18:53:26 UTC Last attempted2026-11-10 18:55:19 UTC
Yanked	Not configured No reliable monitor identity/configuration.	—

Monitor	Checks
Source	6367 Stale 17 CheckFailed
Version	5505 Stale 164 CheckFailed 707 Not configured 8 Input unavailable
Build	6382 Checked 2 Not yet checked
GitHub	6384 Checked
EOL	6260 Not configured 118 Checked 3 Metadata unavailable 3 Input unavailable
LicenseDiff	1665 Not configured 187 Input changed 3168 Not applicable 12 Input unavailable 1139 Checked 209 Metadata unavailable 4 CheckFailed
Dependencies	1852 Not configured 3214 Checked 1248 Metadata unavailable 7 Input unavailable 58 Partial evidence 5 CheckFailed
Advisory	4996 Checked 1375 Not configured 7 Input unavailable 6 Metadata unavailable
Yanked	2248 Not configured 4116 Checked 5 CheckFailed 7 Input unavailable 8 Metadata unavailable