CVE-2026-58051

libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2_publickey_list_free operating on an uninitialized entry. A malicious SSH server offering the publickey subsystem can use a malformed response to make cleanup free an uninitialized, attacker-influenceable attrs pointer in a connecting libssh2 client.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/bikini/exploitarium/tree/main/libssh2-publickey-list-calc-poc	Broken Link
https://github.com/libssh2/libssh2/blob/master/src/publickey.c	Product
https://www.vulncheck.com/advisories/libssh2-free-of-uninitialized-pointer-in-publickey-list-cleanup	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:libssh2:libssh2:*:*:*:*:*:*:*:*

History

25 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) libssh2 hasta la versión 1.11.1 aumenta su lista de claves públicas con SSH2_REALLOC pero no inicializa a cero las nuevas entradas antes de que el análisis las complete, por lo que un fallo de análisis que alcanza la ruta de limpieza deja a libssh2_publickey_list_free operando sobre una entrada no inicializada. Un servidor SSH malicioso que ofrece el subsistema publickey puede usar una respuesta malformada para hacer que la limpieza libere un puntero attrs no inicializado y que puede ser influenciado por el atacante en un cliente libssh2 que se conecta.

Information

Published : 2026-06-28 02:16

Updated : 2026-10-25 17:10

NVD link : CVE-2026-58051

Mitre link : CVE-2026-58051

CVE.ORG link : CVE-2026-58051

JSON object : View

Products Affected

libssh2

libssh2

CWE

CWE-908

Use of Uninitialized Resource

{"id": "CVE-2026-58051", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-58051", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-29T12:49:30.651264Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 2.2}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "libssh2", "product": "libssh2", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.11.1"}], "defaultStatus": "affected"}]}], "published": "2026-06-28T02:16:32.153", "references": [{"url": "https://github.com/bikini/exploitarium/tree/main/libssh2-publickey-list-calc-poc", "tags": ["Broken Link"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/libssh2/libssh2/blob/master/src/publickey.c", "tags": ["Product"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/libssh2-free-of-uninitialized-pointer-in-publickey-list-cleanup", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-908"}]}], "descriptions": [{"lang": "en", "value": "libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2_publickey_list_free operating on an uninitialized entry. A malicious SSH server offering the publickey subsystem can use a malformed response to make cleanup free an uninitialized, attacker-influenceable attrs pointer in a connecting libssh2 client."}, {"lang": "es", "value": "libssh2 hasta la versi\u00f3n 1.11.1 aumenta su lista de claves p\u00fablicas con SSH2_REALLOC pero no inicializa a cero las nuevas entradas antes de que el an\u00e1lisis las complete, por lo que un fallo de an\u00e1lisis que alcanza la ruta de limpieza deja a libssh2_publickey_list_free operando sobre una entrada no inicializada. Un servidor SSH malicioso que ofrece el subsistema publickey puede usar una respuesta malformada para hacer que la limpieza libere un puntero attrs no inicializado y que puede ser influenciado por el atacante en un cliente libssh2 que se conecta."}], "lastModified": "2026-10-25T17:10:00.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:libssh2:libssh2:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "00D62356-F677-41CF-AC66-2871AD2112BA", "versionEndIncluding": "1.11.1"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}