Skip to main content

libssh2 EUVDEUVD-2026-39971

| CVE-2026-58051 HIGH
Use of Uninitialized Resource (CWE-908)
2026-06-28 VulnCheck GHSA-c5f3-hwj2-xp5p
Information Disclosure Libssh2 Red Hat Suse
8.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.3 MEDIUM
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.5 MEDIUM

Network-reachable but victim must connect to a malicious server and attacker must shape an uninitialized pointer (AC:H); no auth (PR:N); primary impact is crash/DoS (A:H) with limited integrity, no confidentiality (C:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
6.5 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Red Hat
6.5 MEDIUM
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Analysis Generated
Jun 28, 2026 - 02:30 vuln.today
Severity Changed
Jun 28, 2026 - 02:22 NVD
MEDIUM HIGH
CVSS changed
Jun 28, 2026 - 02:22 NVD
6.5 (MEDIUM) 8.3 (HIGH)

DescriptionCVE.org

libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2_publickey_list_free operating on an uninitialized entry. A malicious SSH server offering the publickey subsystem can use a malformed response to make cleanup free an uninitialized, attacker-influenceable attrs pointer in a connecting libssh2 client.

AnalysisAI

Free of an uninitialized, attacker-influenceable pointer in libssh2 through 1.11.1 allows a malicious SSH server to corrupt memory in any connecting client that uses the publickey subsystem. The publickey list is grown via SSH2_REALLOC without zero-initializing new entries, so a server-induced parse failure that reaches the cleanup path causes libssh2_publickey_list_free to operate on an uninitialized attrs pointer. Publicly available exploit code exists (reported by VulnCheck); no public evidence of active exploitation, and it is not listed in CISA KEV.

Technical ContextAI

libssh2 is a widely embedded C client library implementing the SSH2 protocol, used inside tools and runtimes such as curl, git, PHP's ssh2 extension, and numerous appliances and applications that initiate SSH connections. The flaw is classed as CWE-908 (Use of Uninitialized Resource): in src/publickey.c the client's publickey list is expanded with SSH2_REALLOC, but the newly allocated entry slots are not zeroed before parsing fills them in. If parsing of a server response fails partway through, control reaches the cleanup routine while one or more entries still contain indeterminate stack/heap garbage. libssh2_publickey_list_free then iterates and frees the attrs pointer of an entry that was never initialized, calling free() on an attacker-influenceable, uninitialized pointer value. The single affected CPE is cpe:2.3:a:libssh2:libssh2:*:*:*:*:*:*:*:* across all versions up to and including 1.11.1.

RemediationAI

No vendor-released patched version is identified in the provided data; the references point to the upstream source file (src/publickey.c) and the VulnCheck advisory rather than a tagged release, so the released patched version is not independently confirmed - track the VulnCheck advisory (https://www.vulncheck.com/advisories/libssh2-free-of-uninitialized-pointer-in-publickey-list-cleanup) and the libssh2 project for a fixed tag above 1.11.1 and upgrade as soon as it ships, then rebuild and redeploy all downstream software linked against libssh2. Until a fix is available, the most effective compensating control is to avoid initiating libssh2-based SSH connections to untrusted or attacker-controlled servers and to pin clients to known-good, fingerprint-verified hosts, since the attack requires the client to connect to a malicious server (this limits flexibility where dynamic/unknown endpoints are needed). Where feasible, avoid or disable use of the publickey subsystem code path in client configurations, accepting the loss of that authentication feature, and apply strict host-key verification to reduce exposure to rogue servers.

More in Libssh2

View all
CVE-2023-48795 MEDIUM POC
5.9 Dec 18

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
CVE-2026-55200 CRITICAL POC
9.2 Jun 17

Remote code execution in libssh2 through version 1.11.1 stems from an unchecked packet_length field in ssh2_transport_re
CVE-2026-58050 HIGH POC
8.3 Jun 28

Heap buffer overflow in the libssh2 SSH client library (all versions through 1.11.1) lets a malicious or compromised SSH
CVE-2019-17498 HIGH POC
8.1 Oct 21

In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds che
CVE-2019-13115 HIGH POC
8.1 Jul 16

In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow t
CVE-2019-3861 CRITICAL
9.1 Mar 25

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value gre
CVE-2019-3860 CRITICAL
9.1 Mar 25

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed
CVE-2019-3858 CRITICAL
9.1 Mar 21

An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from

CVE-2019-3862 CRITICAL
9.1 Mar 21

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exi
CVE-2019-3859 CRITICAL
9.1 Mar 21

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_req
CVE-2019-3857 HIGH
8.8 Mar 25

An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SS
CVE-2019-3856 HIGH
8.8 Mar 25

An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way

Same weakness CWE-908 – Use of Uninitialized Resource

View all
CVE-2011-1255 CRITICAL POC
9.3
CVE-2024-50302 MEDIUM
5.5
CVE-2024-12085 HIGH POC
7.5
CVE-2021-1104 CRITICAL POC
9.8
CVE-2021-29937 CRITICAL POC
9.8
CVE-2021-29936 CRITICAL POC
9.8
CVE-2021-26305 CRITICAL POC
9.8
CVE-2019-9641 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

Debian

libssh2
Release Status Fixed Version Urgency
bullseye vulnerable 1.9.0-2+deb11u1 -
bookworm vulnerable 1.10.0-3 -
trixie vulnerable 1.11.1-1 -
trixie (security) vulnerable 1.11.1-1+deb13u1 -
forky, sid vulnerable 1.11.1-4 -
(unstable) fixed (unfixed) -

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected
SUSE Linux Enterprise Micro 5.5 Affected

Share

EUVD-2026-39971 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy