CVE-2026-58050

A flaw in libssh2 allows a malicious SSH server to trigger a memory overflow by sending a manipulated attribute count. This can cause the connecting client to crash or allow unauthorized code execution.

This Moderate impact flaw in libssh2 allows a malicious SSH server to trigger a heap buffer overflow in a connecting client. By manipulating the publickey-subsystem response, an attacker could cause an integer overflow, potentially leading to denial of service or arbitrary code execution on Red Hat systems using libssh2 to establish SSH connections.

Note: Red Hat Enterprise Linux (RHEL) 8 and newer are not affected by this flaw, as they do not ship the libssh2 package.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue,ensure your applications are running strictly on 64-bit architectures, which naturally prevents the integer overflow from occurring. Additionally, configure your applications to connect only to trusted, verified SSH servers.