CVE Tracker

CVE-2026-66033 @ Helios

Status
accepted_risk
Priority
1.12
Match score
4.0
Risk
InfoLeak MemCorrupt DoS
CVSS
7.5 HIGH
Reason
cpe: libssh2; pkgs: libssh2-1; version: in-range: libssh2-1-1.9.0-2+deb11u1; debian:bullseye libssh2 open; risk:info_disclosure
Created
2026-08-03T02:34:45Z
Updated
2026-08-14T10:17:23Z
Closed
2026-08-03T02:45:15Z

Package interrogation (copy)

Run on the host — click to copy a command. Debian/apt

PackageCommands
libssh2-1-1.9.0-2+deb11u1
libssh2-1

Inventory lookup

Search package inventory across systems, then return here. Create a ticket on systems the matcher missed.

Clear

Suggestions: libssh2 · libssh2-1

SystemMatchesTicket for CVE-2026-66033
Helios libssh2-1 1.9.0-2+deb11u1 accepted_risk open
morris alt-libssh2 1.8.0; alt-libssh211 1.11.1; libssh2 1.8.0; libssh2-devel 1.8.0 accepted_risk open
mufasa alt-libssh2 1.8.0; alt-libssh211 1.11.1; libssh2 1.8.0 accepted_risk open
Archive libssh2-1 1.8.0-2.1+deb10u1 none
Bullseye libssh2-1 1.9.0-2+deb11u1 none
Janus libssh2-1 1.8.0-2.1+deb10u1 none
Library libssh2-1 1.7.0-1+deb9u2 none
Matrix libssh2-1 1.10.0-3+b1 none
Saiph libssh2-1 1.8.0-2.1+deb10u1 none
Silk alt-libssh2 1.11.1-1.6; libssh2-1 1.10.0-3+b1 none

Same product CVEs in your queue

Other tickets that look like the same product (from match reason). Relate them here to triage this CVE as the primary.

CVECVSSKEVSystemsStatus MatchedAlready related
CVE-2026-66032 8.8 Helios, morris, mufasa accepted_risk libssh2 —
CVE-2026-66034 7.5 Helios, morris, mufasa accepted_risk, not_applicable libssh2 → CVE-2026-66033 linked here
CVE-2026-66035 7.5 morris, mufasa not_applicable libssh2 → CVE-2026-66033 linked here

Related CVE (same fix)

Point this ticket’s CVE at a higher-priority / same-fix primary so you only triage one.

Other CVEs related to this one as primary:

Related CVENoteTickets
CVE-2026-66034 same product as CVE-2026-66033 morris, mufasa, Helios
CVE-2026-66035 same product as CVE-2026-66033 morris, mufasa

Host OS / kernel

OS
Debian GNU/Linux 11 (bullseye) (11) · debian
Arch
aarch64
kernel_release
uname -r → 6.1.21-v8+
kernel_version
uname -v → #1642 SMP PREEMPT Mon Apr 3 17:24:16 BST 2023

For Linux kernel CVEs, kernel_version (Debian packaging / build string) often decides fixed vs not; kernel_release is used for upstream NVD range compares.

Same CVE on other hosts

Open the ticket for this CVE on another system.

System Status Priority Updated
morris accepted_risk 7.5 2026-08-22T10:16:55Z Open
mufasa accepted_risk 7.5 2026-08-22T10:16:55Z Open

Description

libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2_cipher_crypt() function in src/openssl.c that allows a malicious SSH server to crash any connecting client by negotiating AES-GCM ciphers during handshake. Attackers can exploit the underflow in the expression computing blocksize minus aadlen minus authentication tag length to trigger an out-of-bounds read and a memcpy call with a near-SIZE_MAX length argument, causing immediate process crash before any authentication occurs.

Determination

This is a client-side Denial of Service. 
Any application that uses this libssh2 library to connect to an untrusted SSH server can be crashed by that server.

Update status

Also apply to other systems with this CVE:

Add note only

Also add note on:

Mitigation log

2026-08-03T02:39:18Z — affects
This is a client-side Denial of Service. Any application that uses this libssh2 library to connect to an untrusted SSH server can be crashed by that server.
2026-08-03T02:40:44Z
No real danger since we dont ssh to untrusted servers.

References

NVD: CVE-2026-66033