CVE-2026-66033 libssh2 CVE debrief

Who should care

Developers and administrators using libssh2 for secure shell connections should be aware of this vulnerability and take immediate action to update to a fixed version. Affected operators should prioritize patching, as this vulnerability allows for a denial of service attack without authentication. Platform teams should review and update any dependent projects or applications that use libssh2. Vulnerability management and security teams should consider implementing additional security measures, such as restricting SSH access or monitoring for suspicious activity.

Technical summary

The vulnerability exists in the ssh2_cipher_crypt() function in src/openssl.c of libssh2 through 1.11.1. A malicious SSH server can exploit this integer underflow by negotiating AES-GCM ciphers during the handshake, leading to a crash of the connecting client. The underflow occurs in the computation of blocksize minus aadlen minus authentication tag length, which triggers an out-of-bounds read and a memcpy call with a large length argument.

Defensive priority

High priority should be given to updating libssh2 to a version that includes the fix, as this vulnerability allows for a denial of service attack without authentication.

Recommended defensive actions

• Update libssh2 to a version that includes the fix (commit a2ed82d or later)
• Review and update any dependent projects or applications that use libssh2
• Consider implementing additional security measures, such as restricting SSH access or monitoring for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record was published on 2026-07-24T17:17:35.263Z and was last modified on 2026-07-27T17:16:41.270Z. The NVD entry is currently available. Evidence is limited to public sources and may not reflect the full scope of affected systems. Defenders should verify the vulnerability's impact on their specific environments and review the official advisory for further details.

Official resources