Bug 2506853 (CVE-2026-66033)

Summary:	CVE-2026-66033 libssh2: libssh2: Denial of Service via integer underflow in AES-GCM cipher negotiation
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	kshier, rhel-process-autobot, stcannon, teagle, watson-tool-maintainers, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in libssh2. A pre-authentication integer underflow vulnerability exists in the `ssh2_cipher_crypt()` function when negotiating AES-GCM ciphers during the handshake. A malicious SSH server can exploit this to trigger an out-of-bounds read and a memory copy operation with an extremely large length argument, leading to an immediate client process crash. This vulnerability results in a Denial of Service (DoS) for any connecting client.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2507356, 2507357, 2507358
Bug Blocks:

Description OSIDB Bzimport 2026-07-24 17:02:31 UTC

libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2_cipher_crypt() function in src/openssl.c that allows a malicious SSH server to crash any connecting client by negotiating AES-GCM ciphers during handshake. Attackers can exploit the underflow in the expression computing blocksize minus aadlen minus authentication tag length to trigger an out-of-bounds read and a memcpy call with a near-SIZE_MAX length argument, causing immediate process crash before any authentication occurs.