Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2_publickey_list_free operating on an uninitialized entry. A malicious SSH server offering the publickey subsystem can use a malformed response to make cleanup free an uninitialized, attacker-influenceable attrs pointer in a connecting libssh2 client.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-06-28 | 3 | Disclosure1Patch2 |
| 2026-06-29 | 1 | General1 |
Some increased actor activities are shown targeting libssh2 (CVE-2026-58051) https://vuldb.com/vuln/374504/cti
Post summary
The post notes that actor activity is reportedly increasing against libssh2 CVE-2026-58051, but no exploit, PoC, or mitigation details are provided.
🚨High - libssh2 Multiple Memory Corruption Issues (CVE-2026-58050 & CVE-2026-58051) Two related vulnerabilities in libssh2 through 1.11.1: CVE-2026-58050: Integer overflow in publickey subsystem attribute allocation on 32-bit platforms allows heap buffer overflow. CVE-2026-58051: Uninitialized pointer free in publickey list cleanup after parse failure. A malicious SSH server can trigger both with malformed publickey responses, leading to memory corruption, denial of service, or potentially arbitrary code execution in the client. 👉Affected: libssh2 <= 1.11.1 Action: Upgrade to the latest patched version.
Post summary
The post announces two critical memory corruption vulnerabilities in libssh2 and urges users to upgrade to patched versions to mitigate potential denial of service or arbitrary code execution.
CVE-2026-58051 Use-After-Free Vulnerability in libssh2 Through 1.11.1 Public Key Parsing https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-58051
Post summary
This brief notice announces a Use‑After‑Free flaw in libssh2 (up to v1.11.1) during public key parsing and links to a vulnerability details page.
High CVSS 8.3 CVE-2026-58051 affects libssh2 through 1.11.1. Review dependencies and apply updates. https://nvd.nist.gov/vuln/detail/CVE-2026-58051 via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/EojTn7PZQR
Post summary
The tweet highlights a high-severity CVE-2026-58051 in libssh2, urging users to review dependencies and apply updates.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | libssh2 | libssh2 | - | - | - |