{"attribution":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","cve":{"id":"CVE-2026-66033","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-07-24T17:17:35.263","lastModified":"2026-11-08T16:10:00.183","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2_cipher_crypt() function in src/openssl.c that allows a malicious SSH server to crash any connecting client by negotiating AES-GCM ciphers during handshake. Attackers can exploit the underflow in the expression computing blocksize minus aadlen minus authentication tag length to trigger an out-of-bounds read and a memcpy call with a near-SIZE_MAX length argument, causing immediate process crash before any authentication occurs."},{"lang":"es","value":"libssh2 hasta 1.11.1, corregido en el commit a2ed82d, contiene una vulnerabilidad de desbordamiento negativo de enteros (integer underflow) pre-autenticación en la función ssh2_cipher_crypt() en src/openssl.c que permite a un servidor SSH malicioso bloquear cualquier cliente que se conecte al negociar cifrados AES-GCM durante el handshake. Los atacantes pueden explotar el desbordamiento negativo en la expresión que calcula blocksize menos aadlen menos la longitud de la etiqueta de autenticación para desencadenar una lectura fuera de límites (out-of-bounds read) y una llamada a memcpy con un argumento de longitud cercano a SIZE_MAX, causando el bloqueo inmediato del proceso antes de que ocurra cualquier autenticación."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"libssh2","product":"libssh2","defaultStatus":"affected","repo":"https://github.com/libssh2/libssh2","packageURL":"pkg:github/libssh2/libssh2","versions":[{"version":"0","lessThanOrEqual":"1.11.1","versionType":"semver","status":"affected"},{"version":"a2ed82d40964bbc0d64cd717aa0a5a892117d2e6","versionType":"git","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-27T16:15:25.211388Z","id":"CVE-2026-66033","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"},{"lang":"en","value":"CWE-191"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:libssh2:libssh2:*:*:*:*:*:*:*:*","versionEndIncluding":"1.11.1","matchCriteriaId":"00D62356-F677-41CF-AC66-2871AD2112BA"}]}]}],"references":[{"url":"https://github.com/libssh2/libssh2/commit/a2ed82d40964bbc0d64cd717aa0a5a892117d2e6","source":"disclosure@vulncheck.com","tags":["Patch"]},{"url":"https://github.com/libssh2/libssh2/pull/2401","source":"disclosure@vulncheck.com","tags":["Issue Tracking","Patch"]},{"url":"https://www.vulncheck.com/advisories/libssh2-integer-underflow-dos-via-aes-gcm-cipher-negotiation","source":"disclosure@vulncheck.com","tags":["Patch","Third Party Advisory"]}]}}