24 results · Feed
-
High 7.5
libssh2 Heap Buffer Overflow via ETM Cipher Negotiation
libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packet_length smaller than the ci…
-
High 7.5
libssh2 Heap Out-of-Bounds Read via publickey subsystem
libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of an uninitialized pointer via the publickey subsystem. In lib…
-
High 7.5
libssh2 Integer Underflow DoS via AES-GCM Cipher Negotiation
libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2_cipher_crypt() function in src/openssl.c that allows a malicious SSH server to crash any connecting client by negotiating AES-GCM cipher…
-
High 8.8
libssh2 Double-Free Heap Corruption via sftp_open()
libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds …
-
Medium 6.5
libssh2 - Free of Uninitialized Pointer in publickey List Cleanup
libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2_publickey_list_free operating on an uninitialized entry. A ma…
-
High 7.0
libssh2 - Integer Overflow in publickey Subsystem Attribute Allocation
libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation num_attrs * sizeof(libssh2_publickey_attribute) without bounds checking, so on 32-bit platforms the multiplication ove…
-
Medium 6.5
libssh2 - Heap Buffer Over-read via sftp_symlink() in sftp.c
libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c that allows a malicious SSH server or man-in-the-middle attacker to disclose heap memory contents or cause a crash …
-
High 8.1CVE-2026-55200 Public exploit
libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c
libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length value…
-
Medium 5.9
libssh2 - Pre-Authentication DoS via SSH_MSG_EXT_INFO Handler
libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extens…
-
High 7.3
libssh2 userauth.c userauth_password integer overflow
A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be lau…
-
Unscored —
An issue was discovered in function _libssh2_packet_add in libssh2 1.10.0 allows attackers to access out of bounds memo…
-
Unscored —CVE-2019-17498 Public exploit
In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds ch…
-
Unscored —
In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow …
-
High 7.5
An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way…
-
High 7.5
An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way S…
-
Medium 5.0
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parse…
-
Medium 5.0
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value gr…
-
High 7.5
A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. A server could send a multipl…
-
Medium 5.0
An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from…
-
High 7.5
An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way p…
-
High 7.3
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an ex…
-
Medium 5.0
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_re…
-
Unscored —
The diffie_hellman_sha256 function in kex.c in libssh2 before 1.7.0 improperly truncates secrets to 128 or 256 bits, wh…
-
Unscored —
The kex_agree_methods function in libssh2 before 1.5.0 allows remote servers to cause a denial of service (crash) or ha…