CVE-2026-58051 Details
Description
libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2_publickey_list_free operating on an uninitialized entry. A malicious SSH server offering the publickey subsystem can use a malformed response to make cleanup free an uninitialized, attacker-influenceable attrs pointer in a connecting libssh2 client.
A vulnerability exists in libssh2 versions through 1.11.1, where the public key list is expanded using SSH2_REALLOC without properly initializing new entries. This oversight can cause the public key list cleanup function to operate on uninitialized data. A malicious SSH server can exploit this by sending a malformed response that tricks the cleanup process into freeing an uninitialized, attacker-controlled attributes pointer in a libssh2 client.
Users can upgrade to libssh2 versions after 1.11.1, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-908 | Use of Uninitialized Resource | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libssh2 libssh2 | <= 1.11.1 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 30, 2026 | Initial Analysis | [email protected] |
| Jun 29, 2026 | CVE Modified | CISA-ADP |
| Jun 28, 2026 | New CVE Received | [email protected] |