CVE-2026-58051
EUVD-2026-3997128.06.2026, 02:16
libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2_publickey_list_free operating on an uninitialized entry. A malicious SSH server offering the publickey subsystem can use a malformed response to make cleanup free an uninitialized, attacker-influenceable attrs pointer in a connecting libssh2 client.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| libssh2 | libssh2 | 𝑥 ≤ 1.11.1 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources
(CNA/ADP records, vendor advisories, Enginsight analysis).
| Vendor | Product | Version | Source |
|---|---|---|---|
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP \(6ES7518-4AX00-1AB0\) | V3.1.7 ≤ 𝑥 < * | ADP |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP \(6ES7518-4AX00-1AC0\) | V3.1.7 ≤ 𝑥 < * | ADP |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP \(6ES7518-4FX00-1AB0\) | V3.1.7 ≤ 𝑥 < * | ADP |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP \(6ES7518-4FX00-1AC0\) | V3.1.7 ≤ 𝑥 < * | ADP |
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP \(6AG1518-4AX00-4AC0\) | V3.1.7 ≤ 𝑥 < * | ADP |
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| libssh2 |
|
openSUSE / SLES Releases
openSUSE Product | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| libssh2-1 |
| ||||||||||||||||||||||||
| libssh2-1-32bit |
| ||||||||||||||||||||||||
| libssh2-devel |
|
Amazon Linux Releases
Amazon Package | |||||
|---|---|---|---|---|---|
| libssh2 |
| ||||
| libssh2-debuginfo |
| ||||
| libssh2-debugsource |
| ||||
| libssh2-devel |
| ||||
| libssh2-docs |
|
Azure Linux Releases
Common Weakness Enumeration