CVE-2026-58050 libssh2 - Integer Overflow in publickey Subsystem Attribute Allocation

What is CVE-2026-58050?

CVE-2026-58050 is a high-severity vulnerability in libssh2, published on 28 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation num_attrs * sizeof(libssh2_publickey_attribute) without bounds checking, so on 32-bit platforms the multiplication overflows to an undersized buffer. A malicious SSH server can then drive the attribute-parsing loop to write past the allocation, causing a heap buffer overflow in a connecting libssh2 client.

Weakness: CWE-190

Which versions are affected by CVE-2026-58050?

It affects 1 product.

Products include Libssh2 Libssh2.

How do I fix CVE-2026-58050?

Upgrade to a fixed version.

Is CVE-2026-58050 being exploited?

There is no known exploitation of CVE-2026-58050 in the wild and no public exploit code.

Other vulnerabilities in libssh2

• CVE-2026-55200 libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c Critical 9.2
• CVE-2026-66032 libssh2 Double-Free Heap Corruption via sftp_open() High 8.7
• CVE-2026-66033 libssh2 Integer Underflow DoS via AES-GCM Cipher Negotiation High 8.7
• CVE-2026-58051 libssh2 - Free of Uninitialized Pointer in publickey List Cleanup High 8.3
• CVE-2025-15661 libssh2 - Heap Buffer Over-read via sftp_symlink() in sftp.c High 8.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2026-58050, AZL-97407, AZL-97434, BELL-CVE-2026-58050, CLSA-2026-1783634800, CLSA-2026-1783635077 and 11 more.