CVE-2026-66035: libssh2 Heap Buffer Overflow via ETM Cipher Negotiation
libssh2 Heap Buffer Overflow via ETM Cipher Negotiation
Other sources
libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packetlength smaller than the cipher's block size during Encrypt-then-MAC cipher negotiation. In the fullpacket() function in src/transport.c, the ETM path allocates a buffer of packetlength bytes but copies blocksize minus one bytes via memcpy, causing an overflow that on 32-bit glibc writes attacker-controlled bytes into an adjacent chunk's SIZE field, enabling tcache bin confusion, overlapping live objects, and function pointer overwrite during the session handshake before authentication.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.11.1-5 - Upgrade
Upgrade
libssh2to a version that resolves this vulnerability.Fixed in 1.11.1Patch 42e33d8 - Compensating control
Mitigate exposure by preventing untrusted/malicious SSH servers from initiating Encrypt-then-MAC (ETM) cipher negotiation with libssh2 clients (e.g., restrict outbound SSH to trusted hosts/allowlists at the network level).
- Operational
After upgrading to the fixed libssh2 commit, restart the affected client/session processes to clear any potential heap corruption effects from pre-authentication handshake packets.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66035?
CVE-2026-66035 has a high severity rating of 7.5.
How do I fix CVE-2026-66035?
To fix CVE-2026-66035, update libssh2 to version 1.11.1 or later.
What type of vulnerability is CVE-2026-66035?
CVE-2026-66035 is a heap buffer overflow vulnerability.
What can exploit CVE-2026-66035?
CVE-2026-66035 can be exploited by a malicious SSH server sending a packet with a packet_length smaller than the cipher's block size.
What impact does CVE-2026-66035 have on affected systems?
CVE-2026-66035 can allow a malicious actor to corrupt heap metadata in any connecting client.