CVE-2026-58050
Publication date 28 June 2026
Last updated 13 July 2026
Ubuntu priority
Description
libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation num_attrs * sizeof(libssh2_publickey_attribute) without bounds checking, so on 32-bit platforms the multiplication overflows to an undersized buffer. A malicious SSH server can then drive the attribute-parsing loop to write past the allocation, causing a heap buffer overflow in a connecting libssh2 client.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| libssh2 | 26.04 LTS resolute |
Fixed 1.11.1-1ubuntu0.26.04.3
|
| 24.04 LTS noble |
Fixed 1.11.0-4.1ubuntu0.24.04.3
|
|
| 22.04 LTS jammy |
Needs evaluation
|
|
| 20.04 LTS focal |
Needs evaluation
|
|
| 18.04 LTS bionic |
Needs evaluation
|
|
| 14.04 LTS trusty |
Needs evaluation
|
Severity score breakdown
CVSS version:
Base score
8.3 · High
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
Base score
7.0 · High
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
References
Related Ubuntu Security Notices (USN)
- USN-8532-1
- libssh2 vulnerabilities
- 13 July 2026
Other references
- https://www.cve.org/CVERecord?id=CVE-2026-58050
- https://github.com/bikini/exploitarium/tree/main/libssh2-publickey-list-calc-poc
- https://github.com/libssh2/libssh2/blob/master/src/publickey.c
- https://www.vulncheck.com/advisories/libssh2-integer-overflow-in-publickey-subsystem-attribute-allocation
- https://github.com/libssh2/libssh2/pull/2205#discussion_r3523193089