CVE-2026-58051: libssh2 - Free of Uninitialized Pointer in publickey List Cleanup

Published Jun 28, 2026
·
Updated

Last updated 13 July 2026

Other sources

libssh2 through 1.11.1 grows its publickey list with SSH2REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2publickeylistfree operating on an uninitialized entry. A malicious SSH server offering the publickey subsystem can use a malformed response to make cleanup free an uninitialized, attacker-influenceable attrs pointer in a connecting libssh2 client.

MITRE

Affected Software

3 affected components
libssh2 libssh2<=1.11.1
libssh2 libssh2<=1.11.1
debian/libssh2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade libssh2 to a version that resolves this vulnerability.

    Fixed in 1.11.1

Event History

Jun 28, 2026
CVE Published
via MITRE·01:32 AM
Data Sourced
via MITRE·01:32 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:16 AM
DescriptionSeverityWeaknessAffected Software
Jul 13, 2026
Data Sourced
via Debian·02:23 PM
DescriptionAffected Software
Data Sourced
via Launchpad·02:23 PM
Description
Jul 14, 2026
Data Sourced
via Ubuntu·02:23 PM
RemedyDescriptionSeverityAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-58051?

The severity of CVE-2026-58051 is medium with a CVSS score of 6.5.

2

How do I fix CVE-2026-58051?

To fix CVE-2026-58051, upgrade libssh2 to version 1.11.2 or later where the issue is resolved.

3

What software is affected by CVE-2026-58051?

The affected software is libssh2, specifically versions prior to 1.11.2.

4

What is the primary issue in CVE-2026-58051?

The primary issue in CVE-2026-58051 is the handling of uninitialized pointers in the publickey list cleanup process.

5

Can CVE-2026-58051 be exploited remotely?

Yes, CVE-2026-58051 can be exploited by a malicious SSH server offering a public key.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203