CVE Tracker

CVE-2026-66032 @ mufasa

Status
accepted_risk
Priority
8.8
Match score
4.0
Risk
MemCorrupt Remote priv:user
CVSS
8.8 HIGH
Reason
cpe: libssh2; pkgs: libssh2; version: in-range: libssh2-1.8.0-4.el7_9.1.tuxcare.els3; risk:memory_corruption
Created
2026-08-07T10:15:38Z
Updated
2026-08-22T10:16:19Z
Closed
2026-08-07T15:10:59Z

Package interrogation (copy)

Run on the host — click to copy a command. RPM

PackageCommands
libssh2-1.8.0-4.el7_9.1.tuxcare.els3

Inventory lookup

Search package inventory across systems, then return here. Create a ticket on systems the matcher missed.

Clear

Suggestions: libssh2

SystemMatchesTicket for CVE-2026-66032
Helios libssh2-1 1.9.0-2+deb11u1 accepted_risk open
morris alt-libssh2 1.8.0; alt-libssh211 1.11.1; libssh2 1.8.0; libssh2-devel 1.8.0 accepted_risk open
mufasa alt-libssh2 1.8.0; alt-libssh211 1.11.1; libssh2 1.8.0 accepted_risk open
Archive libssh2-1 1.8.0-2.1+deb10u1 none
Bullseye libssh2-1 1.9.0-2+deb11u1 none
Janus libssh2-1 1.8.0-2.1+deb10u1 none
Library libssh2-1 1.7.0-1+deb9u2 none
Matrix libssh2-1 1.10.0-3+b1 none
Saiph libssh2-1 1.8.0-2.1+deb10u1 none
Silk alt-libssh2 1.11.1-1.6; libssh2-1 1.10.0-3+b1 none

Same product CVEs in your queue

Other tickets that look like the same product (from match reason). Relate them here to triage this CVE as the primary.

CVECVSSKEVSystemsStatus MatchedAlready related
CVE-2026-66033 7.5 Helios, morris, mufasa accepted_risk libssh2 —
CVE-2026-66034 7.5 Helios, morris, mufasa accepted_risk, not_applicable libssh2 → CVE-2026-66033
CVE-2026-66035 7.5 morris, mufasa not_applicable libssh2 → CVE-2026-66033

Related CVE (same fix)

Point this ticket’s CVE at a higher-priority / same-fix primary so you only triage one.

Host OS / kernel

OS
CloudLinux release 7.9 (Boris Yegorov) (7.9) · cloudlinux
Arch
x86_64
kernel_release
uname -r → 3.10.0-962.3.2.lve1.5.89.el7.x86_64
kernel_version
uname -v → #1 SMP Thu Jul 9 15:55:31 UTC 2026

For Linux kernel CVEs, kernel_version (Debian packaging / build string) often decides fixed vs not; kernel_release is used for upstream NVD range compares.

Same CVE on other hosts

Open the ticket for this CVE on another system.

System Status Priority Updated
morris accepted_risk 8.8 2026-08-22T10:16:19Z Open
Helios accepted_risk 1.32 2026-08-22T10:16:19Z Open

Description

libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSH_FXP_OPEN with SSH_FXP_STATUS containing FX_OK, the response data buffer is freed, and if a subsequent sftp_packet_require() call returns a specific error such as LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED, the same pointer is freed a second time, enabling tcache dup conditions on glibc systems that allow overlapping allocations and function pointer overwrites.

Determination

Practical risk on this server
CVE-2026-66032 is only exploitable when a client using libssh2 connects to a malicious SSH server and opens an SFTP session.

On your box the realistic attack paths are:

PHP code that uses the ssh2 extension or curl with SFTP/SCP URLs to connect to untrusted hosts.
Scripts or cron jobs that call system curl with sftp:// or scp://.
Any backup / remote-sync tool that uses libssh2 (less common on cPanel, but possible with custom tools).

Most of the PHP-FPM / lsphp processes simply have the library mapped because ea-libcurl (or a PHP ssh2 module) is loaded. That alone does not mean they are actively using SFTP.
Risk assessment for this server

ComponentStatusRisklibssh2 library itself | Vulnerable (1.8.0) | Present
PHP ssh2 extension | Not loaded | None
WordPress SSH2 method | Dead code | None
Backuply Pro (conleypr)  | Has SFTP code | Low–Medium (only if that account actually uses SFTP backups to an untrusted host)System 
curlLinked to vulnerable libssh2 | Low | (no evidence of SFTP usage)
Other processes | Just have the library mapped | Very low

CAGEFS and likelyhood that the WP app connect to untrusted host is near zero.

Update status

Also apply to other systems with this CVE:

Add note only

Also add note on:

Mitigation log

2026-08-07T15:00:18Z — affects
Practical risk on this server CVE-2026-66032 is only exploitable when a client using libssh2 connects to a malicious SSH server and opens an SFTP session. On your box the realistic attack paths are: PHP code that uses the ssh2 extension or curl with SFTP/SCP URLs to connect to untrusted hosts. Scripts or cron jobs that call system curl with sftp:// or scp://. Any backup / remote-sync tool that uses libssh2 (less common on cPanel, but possible with custom tools). Most of the PHP-FPM / lsphp processes simply have the library mapped because ea-libcurl (or a PHP ssh2 module) is loaded. That alone does not mean they are actively using SFTP.
2026-08-07T15:10:59Z — accepted_risk
Risk assessment for this server ComponentStatusRisklibssh2 library itself | Vulnerable (1.8.0) | Present PHP ssh2 extension | Not loaded | None WordPress SSH2 method | Dead code | None Backuply Pro (conleypr) | Has SFTP code | Low–Medium (only if that account actually uses SFTP backups to an untrusted host)System curlLinked to vulnerable libssh2 | Low | (no evidence of SFTP usage) Other processes | Just have the library mapped | Very low CAGEFS and likelyhood that the WP app connect to untrusted host is near zero.

References

NVD: CVE-2026-66032