CVE-2026-66035 Details
Description
libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packet_length smaller than the cipher's block size during Encrypt-then-MAC cipher negotiation. In the fullpacket() function in src/transport.c, the ETM path allocates a buffer of packet_length bytes but copies blocksize minus one bytes via memcpy, causing an overflow that on 32-bit glibc writes attacker-controlled bytes into an adjacent chunk's SIZE field, enabling tcache bin confusion, overlapping live objects, and function pointer overwrite during the session handshake before authentication.
A heap buffer overflow vulnerability has been identified in libssh2 versions prior to 1.11.1. This vulnerability allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a length smaller than the cipher's block size during Encrypt-then-MAC (ETM) cipher negotiation. The issue arises in the fullpacket() function within src/transport.c, where the ETM path allocates a buffer based on the packet length but only copies blocksize minus one bytes, leading to an overflow. On 32-bit glibc systems, this overflow can be exploited to write attacker-controlled bytes into an adjacent chunk's SIZE field. This exploitation causes tcache bin confusion, overlaps live objects, and allows for function pointer overwrites during the session handshake, before authentication.
Users can upgrade to libssh2 version 1.11.1 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/libssh2/libssh2/commit/42e33d81577ed4b95d4b4f6f845e5ee8efe5eeb4 | [email protected] | Patch |
| https://github.com/libssh2/libssh2/pull/2198 | [email protected] | Issue TrackingPatch |
| https://www.vulncheck.com/advisories/libssh2-heap-buffer-overflow-via-etm-cipher-negotiation | [email protected] | PatchThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-122 | Heap-based Buffer Overflow | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libssh2 libssh2 | <= 1.11.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 30, 2026 | Initial Analysis | [email protected] |
| Jul 25, 2026 | CVE Modified | CISA-ADP |
| Jul 24, 2026 | CVE Modified | CISA-ADP |
| Jul 24, 2026 | New CVE Received | [email protected] |