Loading story…
A high-severity memory-safety flaw tracked as CVE-2026-66032 was disclosed in libssh2 through version 1.11.1, affecting the sftp_open() function in src/sftp.c. The bug allows a malicious SSH server to trigger a double free in an authenticated client that opens an SFTP session, creating heap corruption conditions. Advisory details say the issue occurs when the server responds to SSH_FXP_OPEN with SSH_FXP_STATUS containing FX_OK and a later sftp_packet_require() call returns a specific error such as LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED, causing the same response buffer to be freed twice.
The libssh2 project addressed the flaw in commit 5e4776146552d898b9c0e1b313cd093fa8dc92d0, merged through pull request #2180, by nullifying the pointer after it is freed in the SFTP code. The fix, which also resolves advisory GHSA-px3w-7g75-hg7w, credits VladimirEliTokarev for reporting the issue. Security writeups warn that on glibc-based systems the bug can produce tcache-dup style heap corruption, potentially enabling overlapping allocations and function pointer overwrites, and users are advised to update libssh2 or apply the patch and recompile.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-66032 was published for a high-severity double-free vulnerability in libssh2 through version 1.11.1 affecting sftp_open(). The disclosure states that a malicious SSH server can trigger heap corruption in an authenticated client opening an SFTP session, and notes the issue is fixed by commit 5e4776146552d898b9c0e1b313cd093fa8dc92d0.
A libssh2 pull request to nullify a pointer after freeing it in src/sftp.c was merged into the master branch as commit 5e47761. The change explicitly fixes advisory GHSA-px3w-7g75-hg7w and credits VladimirEliTokarev for the report.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcevulncheck.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple vulnerabilities in **libssh2** have exposed SSH clients and products that embed the library to attacks from malicious or impersonated SSH servers. The most severe issue, **`CVE-2026-55200`**, is a pre-authentication out-of-bounds heap write in `ssh2_transport_read()` that affects all versions through **1.11.1** and could allow remote code execution, while **`CVE-2026-55199`** can force clients into a CPU-intensive loop during key exchange and cause denial of service. The library is widely used in **curl**, backup software, IoT firmware, and network appliances, raising broad supply-chain risk, especially where libssh2 is statically linked or bundled into downstream products. A separate flaw, **`CVE-2025-15661`**, affects `sftp_symlink()` in `src/sftp.c` and can be triggered during SFTP `READLINK` or `REALPATH` operations when a malicious server or man-in-the-middle sends a crafted `SSH_FXP_NAME` response with an oversized `link_len` value. That bug causes a heap buffer over-read that may disclose memory contents or crash applications. Fixes were reported in commits **`97acf3d`**, **`1762685`**, and **`2dae302`**, but at the time of reporting no official libssh2 release containing the newer patches had been published, leaving downstream vendors responsible for shipping their own updates.
Jul 12, 2026
Libssh released versions **0.12.1** and **0.11.5** to fix multiple security issues, including **CVE-2026-59851**, an authentication bypass in deployments where `GSSAPIKeyExchange` is enabled on servers. The flaw allows an authenticated client to log in as an arbitrary local user because the `gssapi-keyex` path fails to verify whether the authenticated Kerberos principal is authorized for the requested account. The vulnerability is tracked as **CWE-863** and carries a **CVSS v3.1** score reflecting high impact to confidentiality, integrity, and availability. The **0.12.1** release addresses **11 CVEs**, while **0.11.5** backports fixes for **8 CVEs** affecting the 0.11 branch. In addition to the authentication bypass, the updates remediate a stack buffer overflow, information disclosure bugs, several denial-of-service conditions, a use-after-free issue, and an integrity downgrade flaw, alongside hardening changes such as zero-initializing `ssh_string` objects and validating peer public keys during Diffie-Hellman key exchange. Red Hat reported **RHEL 8** and **RHEL 9** as unaffected by `CVE-2026-59851`, listed **RHEL 10** status as unknown, and marked **Red Hat Hardened Images** as affected for `libssh` and `libssh2` package entries.
Jul 21, 2026
Two vulnerabilities in **sshfs** were disclosed and fixed in version **3.7.6**, affecting versions up to **3.7.5**. The more severe issue, **CVE-2026-47187**, is a symlink escape flaw that lets a rogue SFTP server trick the client into reading from or writing to unintended paths on the local filesystem by returning unsafe symlink targets. The second bug, **CVE-2026-48711**, is an argument injection weakness in hostname parsing that can turn a crafted mount source into an SSH option, enabling arbitrary local command execution under specific conditions and, in some cases, without requiring SSH authentication. Public technical details and exploit code have now been released, raising the risk of active abuse against systems that use sshfs to mount remote directories over SFTP. The flaws were privately reported by Abhinav Agarwal and addressed through a coordinated release, but defenders are being urged to upgrade immediately to **sshfs 3.7.6 or later** and verify trusted remote server keys, as a malicious or spoofed server could otherwise trigger client-side compromise.
Jun 29, 2026