The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSH_FXP_OPEN with SSH_FXP_STATUS containing FX_OK, the response data buffer is freed, and if a subsequent sftp_packet_require() call returns a specific error such as LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED, the same pointer is freed a second time, enabling tcache dup conditions on glibc systems that allow overlapping allocations and function pointer overwrites.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade libssh2-debuginfoUpgrade libssh2-docsUpgrade libssh2-develUpgrade libssh2 | Oct 19, 2026 | Oct 19, 2026 |
| Amazon_linux_2023 | — | Upgrade libssh2-develUpgrade rust-cargo-c-debugsourceUpgrade libssh2-debugsourceUpgrade cargo-c-debuginfoUpgrade libssh2-debuginfoUpgrade libssh2-docsUpgrade cargo-cUpgrade libssh2 | Aug 18, 2026 | Jul 24, 2026 |
| Debian | — | Upgrade libssh2 | Sep 21, 2026 | Jul 24, 2026 |
| Redhat_linux | — | Upgrade libssh2Upgrade libssh2-debuginfoUpgrade libssh2-develNo solution existsUpgrade libssh2-docs | Jul 29, 2026 | Jul 24, 2026 |
| Ubuntu | — | Upgrade libssh2-1 (Ubuntu Pro)Upgrade libssh2-1-devUpgrade libssh2-1-dev (Ubuntu Pro)Upgrade libssh2-1t64Upgrade libssh2-1 | Sep 14, 2026 | Sep 3, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 2, 2026 | Jul 24, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub