p PatchFirst

CVE-2026-58051

CVE-2026-58051 · libssh2 - Free of Uninitialized Pointer in publickey List Cleanup

This page contains facts from public vulnerability sources. Check the original advisory before updating.

libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2_publickey_list_free operating on an uninitialized entry. A malicious SSH server offering the publickey subsystem can use a malformed response to make cleanup free an uninitialized, attacker-influenceable attrs pointer in a connecting libssh2 client.

CVSS 8.3 · High · EPSS 0.3% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • libssh2

    Versions
    • ≥ 0, ≤ 1.11.1: Affected (semver)

    No fix published

  • libssh2 Debian:12

    Versions
    • 1.10.0-3
    Affected ranges
    • ECOSYSTEM: < 1.10.0-3+deb12u1

    Update to 1.10.0-3+deb12u1

  • libssh2 Debian:13

    Versions
    • 1.11.1-1
    • 1.11.1-1+deb13u1
    Affected ranges
    • ECOSYSTEM: < 1.11.1-1+deb13u2

    Update to 1.11.1-1+deb13u2

  • libssh2 Debian:14

    Versions
    • 1.11.1-1
    • 1.11.1-2
    • 1.11.1-3
    • 1.11.1-4
    • 1.11.1-5
    Affected ranges
    • ECOSYSTEM: < 1.11.1-6

    Update to 1.11.1-6

  • libssh2 Ubuntu:Pro:14.04:LTS

    Versions
    • 1.4.3-1
    • 1.4.3-2
    • 1.4.3-2ubuntu0.1
    • 1.4.3-2ubuntu0.2
    • 1.4.3-2ubuntu0.2+esm1
    • 1.4.3-2ubuntu0.2+esm2
    • 1.4.3-2ubuntu0.2+esm3
    Affected ranges
    • ECOSYSTEM: < 1.4.3-2ubuntu0.2+esm4

    Update to 1.4.3-2ubuntu0.2+esm4

  • libssh2 Ubuntu:Pro:16.04:LTS

    Versions
    • 1.5.0-2
    • 1.5.0-2ubuntu0.1
    • 1.5.0-2ubuntu0.1+esm1
    • 1.5.0-2ubuntu0.1+esm2
    Affected ranges
    • ECOSYSTEM: < 1.5.0-2ubuntu0.1+esm3

    Update to 1.5.0-2ubuntu0.1+esm3

  • libssh2 Ubuntu:Pro:18.04:LTS

    Versions
    • 1.8.0-1
    • 1.8.0-1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: < 1.8.0-1ubuntu0.1+esm1

    Update to 1.8.0-1ubuntu0.1+esm1

  • libssh2 Ubuntu:Pro:20.04:LTS

    Versions
    • 1.8.0-2.1build1
    • 1.8.0-2.1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: < 1.8.0-2.1ubuntu0.1+esm1

    Update to 1.8.0-2.1ubuntu0.1+esm1

  • libssh2 Ubuntu:22.04:LTS

    Versions
    • 1.9.0-3
    • 1.10.0-2
    • 1.10.0-2build1
    • 1.10.0-3
    Affected ranges
    • ECOSYSTEM: < 1.10.0-3ubuntu0.1

    Update to 1.10.0-3ubuntu0.1

  • libssh2 Ubuntu:24.04:LTS

    Versions
    • 1.11.0-2
    • 1.11.0-3
    • 1.11.0-4
    • 1.11.0-4.1build1
    • 1.11.0-4.1build2
    • 1.11.0-4.1ubuntu0.24.04.1
    • 1.11.0-4.1ubuntu0.24.04.2
    Affected ranges
    • ECOSYSTEM: < 1.11.0-4.1ubuntu0.24.04.3

    Update to 1.11.0-4.1ubuntu0.24.04.3

  • libssh2 Ubuntu:25.10

    Versions
    • 1.11.1-1
    • 1.11.1-1build1
    • 1.11.1-1ubuntu0.25.10.1
    • 1.11.1-1ubuntu0.25.10.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libssh2 Ubuntu:26.04:LTS

    Versions
    • 1.11.1-1build1
    • 1.11.1-1build2
    • 1.11.1-1ubuntu0.26.04.1
    • 1.11.1-1ubuntu0.26.04.2
    Affected ranges
    • ECOSYSTEM: < 1.11.1-1ubuntu0.26.04.3

    Update to 1.11.1-1ubuntu0.26.04.3

Original sources

Check your server →