CVE-2026-58051

Publication date 28 June 2026

Last updated 2 September 2026

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

6.5 · Medium

Score breakdown

Description

libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2_publickey_list_free operating on an uninitialized entry. A malicious SSH server offering the publickey subsystem can use a malformed response to make cleanup free an uninitialized, attacker-influenceable attrs pointer in a connecting libssh2 client.

Read the notes from the security team

Status

Package Ubuntu Release Status
libssh2 26.04 LTS resolute
Fixed 1.11.1-1ubuntu0.26.04.3
25.10 questing Ignored end of life, was needs-triage
24.04 LTS noble
Fixed 1.11.0-4.1ubuntu0.24.04.3
22.04 LTS jammy
Needs evaluation
20.04 LTS focal
Needs evaluation
18.04 LTS bionic
Needs evaluation
16.04 LTS xenial
Needs evaluation
14.04 LTS trusty
Needs evaluation

Notes

mdeslaur

Originally, the wrong commit was identified as being the fix for this CVE, but was still included in USN-8532-1 as CVE-2026-5805x-pre1.patch

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
libssh2

Severity score breakdown

CVSS version:

Base score 8.3 · High

Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Base score 6.5 · Medium

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

References

Related Ubuntu Security Notices (USN)

Other references

Access our resources on patching vulnerabilities