CVE-2026-58051

Name of the Vulnerable Software and Affected Versions libssh2 versions prior to 1.11.2

Description An issue exists in the public key parsing process where the software expands its public key list using SSH2 REALLOC but fails to zero-initialize new entries before they are populated. If a parse failure occurs and triggers the cleanup path, the libssh2 publickey list free() function may operate on an uninitialized entry. A malicious SSH server providing the public key subsystem can send a malformed response to cause the client to free an uninitialized attrs pointer, leading to a use-after-free condition.

Recommendations Update libssh2 to version 1.11.2 or later.