CVE-2026-66033Patch(libssh2 / libssh2)

LOWCVSS 8.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch libssh2 libssh2 systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2_cipher_crypt() function in src/openssl.c that allows a malicious SSH server to crash any connecting client by negotiating AES-GCM ciphers during handshake. Attackers can exploit the underflow in the expression computing blocksize minus aadlen minus authentication tag length to trigger an out-of-bounds read and a memcpy call with a near-SIZE_MAX length argument, causing immediate process crash before any authentication occurs.

libssh2 CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

Weakness type (CWE)

CWE-125CWE-191

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

libssh2

Threat summary

Patch or workaround signal is available
5 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 3 signals
Technical details provided in 4 signals
Disclosure: 1 classified signal
Peaked 3d ago at 2 mentions (2026-07-25); latest day: 1
5 total mentions across 4 days

Affected systems

Vendors

libssh2

Products

libssh2

Deep dive

Activity timeline5 mentions / 4d

Signal classification2 categories

Patch

375.0%

Disclosure

125.0%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-25	2	Disclosure1Patch1
2026-07-28	1	Patch1
2026-08-05	1	Patch1

Full discourse5 posts

iototsecnews@iototsecnews80d
Patch
libssh2 の脆弱性 CVE-2026-66032／66033／66034／66035 が FIX：悪意の SSH サーバによるクライアント破壊 https://iototsecnews.jp/2026/07/28/libssh2-vulnerabilities-allow-a-malicious-ssh-server-to-corrupt-client-memory/ libssh2 の脆弱性 CVE-2026-66032／CVE-2026-66033／CVE-2026-66034／CVE-2026-66035 は、接続時のデータ検証やメモリ管理の不備に起因するものです。悪意の送信元との通信により内部の処理が乱され、プログラムの停止や意図しない動作などが引き起こされる恐れがあります。システムを安全に利用するためにも、対策が施された修正版ライブラリへの更新を速やかに実施してください。組み込み型のプログラムを利用している場合には、個別でのアップデート対応が必要になる点にも注意が必要です。 #CVE202666032 #CVE202666033 #CVE202666034 #CVE202666035 #libssh2 #Vulnerability
Post summary
The article reports that libssh2 CVE-2026-66032 through 66035 involve data verification and memory‑management flaws that could allow a malicious SSH server to corrupt client memory, and it urges users to update to the patched library promptly.
02000159
506 followersView on X
GCP Weekly@gcpweekly9d
This addresses the following vulnerabilities: CVE-2026-35189 CVE-2026-35191 CVE-2026-42772 CVE-2026-5450 CVE-2026-54872 CVE-2026-54873 CVE-2026-54875 CVE-2026-58050 CVE-2026-58051 CVE-2026-5928 CVE-2026-66032 CVE-2026-66033 CVE-2026-66034 CVE-2026-66035 CVE-2026-72897 5/16
1000029
1.8K followersView on X
Mohi@disismohi91d
Disclosure
CVE-2026-66033: libssh2 clients crash before they send a password. Thread on what breaks and how to fix it Saturday.
Post summary
An announcement of a new CVE (CVE‑2026‑66033) affecting libssh2 clients, noting a crash prior to password transmission and a forthcoming thread on the issue and its fix.
1000050
72 followersView on X
Rıdvan Yağlı@ridvanyagli87d
Patch
🔴 libssh2'de keşfedilen dört kritik güvenlik açığı (CVE-2026-66032, CVE-2026-66033, CVE-2026-66034 ve CVE-2026-66035), kötü niyetli bir SSH/SFTP sunucusunun istemci uygulamalarında bellek bozulmasına, uygulamanın çökmesine ve bazı senaryolarda potansiyel uzaktan kod çalıştırmaya neden olabilmesine yol açıyor. Etkilenen sürümler: libssh2 1.11.1 ve öncesi. Kullanıcıların ve sistem yöneticilerinin, libssh2'yi veya bu kütüphaneyi kullanan uygulamaları güncel sürüme yükseltmeleri önerilir.
Post summary
Four critical vulnerabilities in libssh2 can cause memory corruption, crashes, and potential remote code execution; users are advised to upgrade to a newer version.
0000084
1.3K followersView on X
Mohi@disismohi91d
Patch
Saturday action: audit your base images for libssh2 version, rebuild if needed, tighten egress to known SSH hosts. Pre-auth crashes are the worst kind. https://nvd.nist.gov/vuln/detail/CVE-2026-66033
Post summary
The tweet advises auditing libssh2 in base images and applying rebuild or network restrictions to mitigate pre‑authentication crashes from CVE‑2026‑66033.
0000033
72 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	libssh2	libssh2	-	-	-

Explore more

Back to dashboard libssh2 CVEs libssh2 vulnerabilities

What researchers are saying

CVE-2026-66033

Rıdvan Yağlı[verified]@ridvanyagliPatch

Four critical vulnerabilities in libssh2 can cause memory corruption, crashes, and potential remote code execution; users are advised to upgrade to a newer version.

iototsecnews@iototsecnewsPatch

The article reports that libssh2 CVE-2026-66032 through 66035 involve data verification and memory‑management flaws that could allow a malicious SSH server to corrupt client memory, and it urges users to update to the patched library promptly.

Mohi@disismohiDisclosure

An announcement of a new CVE (CVE‑2026‑66033) affecting libssh2 clients, noting a crash prior to password transmission and a forthcoming thread on the issue and its fix.

Mohi@disismohiPatch

The tweet advises auditing libssh2 in base images and applying rebuild or network restrictions to mitigate pre‑authentication crashes from CVE‑2026‑66033.