Integer Underflow Vulnerability in libssh2 Affects SSH Clients

CVE-2026-66033

What is CVE-2026-66033?

libssh2 versions up to 1.11.1 have a vulnerability in the ssh2_cipher_crypt() function that allows attackers to trigger a denial-of-service condition. The flaw lies in an integer underflow that occurs during cipher negotiation with malicious SSH servers, specifically when utilizing AES-GCM ciphers. This results in an out-of-bounds read and a memcpy operation that can crash any client attempting to connect, even before any authentication takes place. Users are advised to update to the fixed version to mitigate any risks.

References