A newly disclosed four high-severity vulnerabilities in libssh2, the widely used SSH library embedded in countless client applications, tools, and DevOps pipelines This article explores vulnerabilities libssh2 widely. . A malicious or compromised SSH server can corrupt client-side memory, ranging from crashes to potential remote code execution, simply by responding maliciously during connection or authentication.
Critical Four libssh2 Flaws Rated 8.7 on CVSS v4, this double-free vulnerability (CWE-415), tracked as CVE-2026-66032, resides in sftp_open() in src/sftp.c. By negotiating AES-GCM ciphers during the handshake, a malicious server triggers an integer underflow (CWE-191) in calculating block size minus AAD length minus tag length. By sending a packet with a length smaller than the cipher’s block size, an attacker causes libssh2 to allocate a buffer that is exactly one byte shorter than requested.
These bugs make them attractive for supply-chain-style attacks against CI/CD pipelines, automated deployment tools, and any software embedding libssh2 for outbound SSH/SFTP connections. Given the heap corruption primitives involved, particularly tcache manipulation in CVE-2026-66032 and CVE-2026-66035, these patches should be treated as high-priority updates rather than routine maintenance. Utilize ANY.RUN to cut SOC investigation blind spots and contain threats earlier, reducing response costs and business disruptions.
