CVE-2026-58051: libssh2 - Free of Uninitialized Pointer in publickey List Cleanup
Last updated 13 July 2026
Other sources
libssh2 through 1.11.1 grows its publickey list with SSH2REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2publickeylistfree operating on an uninitialized entry. A malicious SSH server offering the publickey subsystem can use a malformed response to make cleanup free an uninitialized, attacker-influenceable attrs pointer in a connecting libssh2 client.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libssh2to a version that resolves this vulnerability.Fixed in 1.11.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58051?
The severity of CVE-2026-58051 is medium with a CVSS score of 6.5.
How do I fix CVE-2026-58051?
To fix CVE-2026-58051, upgrade libssh2 to version 1.11.2 or later where the issue is resolved.
What software is affected by CVE-2026-58051?
The affected software is libssh2, specifically versions prior to 1.11.2.
What is the primary issue in CVE-2026-58051?
The primary issue in CVE-2026-58051 is the handling of uninitialized pointers in the publickey list cleanup process.
Can CVE-2026-58051 be exploited remotely?
Yes, CVE-2026-58051 can be exploited by a malicious SSH server offering a public key.