VYPR
patchPublished Jul 25, 2026· Updated Jul 26, 2026· 1 source

Libssh2: Three Vulnerabilities Disclosed Together Affecting SFTP and Cipher Negotiation

Key findings • Three Libssh2 vulnerabilities (CVE-2026-66032, CVE-2026-66035, CVE-2026-66033) disclosed on July 25, 2026, affect versions up to 1.11.1. • CVE-2026-66035 and CVE-2026-66033 are…

Key findings

On July 25, 2026, three vulnerabilities in the Libssh2 library, all affecting versions up to 1.11.1, were disclosed. These vulnerabilities, fixed in specific commits to the library's codebase, present significant risks to clients connecting to malicious SSH servers. The disclosures highlight potential weaknesses in how Libssh2 handles SFTP sessions and cipher negotiation, with impacts ranging from heap corruption to denial-of-service conditions.

Two of the disclosed vulnerabilities, CVE-2026-66035 and CVE-2026-66033, are pre-authentication vulnerabilities, meaning they can be exploited by a malicious SSH server before a client has fully authenticated. CVE-2026-66035 is a heap buffer overflow that can occur during cipher negotiation when a server sends a packet with a length smaller than the cipher's block size. This can lead to the corruption of heap metadata in the client. CVE-2026-66033 is an integer underflow vulnerability in the ssh2_cipher_crypt() function, also occurring during AES-GCM cipher negotiation. A malicious server can exploit this to crash any connecting client.

The third vulnerability, CVE-2026-66032, is a double-free vulnerability within the sftp_open() function in src/sftp.c. This vulnerability affects authenticated clients that open an SFTP session. A malicious SSH server can exploit this flaw when responding to an SSH_FXP_OPEN request with an SSH_FXP_STATUS containing FX_OK, leading to heap corruption in the client.

The fixes for these vulnerabilities are available in specific commits: commit 5e47761 addresses CVE-2026-66032, commit 42e33d8 addresses CVE-2026-66035, and commit a2ed82d addresses CVE-2026-66033. Users of Libssh2 are strongly advised to update to a version that includes these fixes to mitigate the risks associated with these vulnerabilities. The consistent disclosure of these issues on the same day suggests a coordinated effort to address a cluster of security flaws within the library.

These vulnerabilities underscore the importance of robust security practices in network communication libraries. Clients relying on Libssh2 should be aware of the potential for malicious servers to exploit these weaknesses, leading to data corruption or service disruption. Prompt patching and vigilance against sophisticated SSH server impersonation are crucial for maintaining secure connections.

The fixes for all three vulnerabilities were integrated into the Libssh2 codebase through specific commits, indicating that a single update incorporating these patches should resolve all disclosed issues. Users should ensure they are running a version of Libssh2 that includes these commits or a later stable release.

The disclosure of these vulnerabilities on July 25, 2026, serves as a reminder for developers and system administrators to stay informed about security updates for critical libraries like Libssh2. Proactive management of software dependencies and timely application of security patches are essential to protect against potential exploitation.

The vulnerabilities collectively impact the integrity and availability of clients connecting to SSH servers that utilize the Libssh2 library. By addressing these flaws, the Libssh2 project aims to enhance the security posture of its users against a variety of server-side attacks.

The fixes for CVE-2026-66032, CVE-2026-66035, and CVE-2026-66033 are available in the Libssh2 codebase. Users should consult the project's release notes or commit history to identify the specific versions containing these fixes. The prompt patching of these issues is critical for preventing potential exploitation by malicious actors.

Synthesized by Vypr AI