# libssh2 1.11.1

the SSH library

Snapshot of gominimal/pkgs commit `3ca85754717bb0395b6c834aad504fa93cbb26eb` (pushed 2026-07-30T21:31:40.000Z).

## Install

```sh
min add libssh2
```

## Direct advisories

| ID | Severity | CVSS | Fix status | Fixed version | Summary |
| --- | --- | --- | --- | --- | --- |
| CVE-2025-15661 | HIGH | — | fixed | — | libssh2 - Heap Buffer Over-read via sftp_symlink() in sftp.c |
| CVE-2026-55199 | HIGH | — | fixed | — | libssh2 - Pre-Authentication DoS via SSH_MSG_EXT_INFO Handler |
| CVE-2026-55200 | CRITICAL | — | fixed | — | libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c |
| CVE-2026-58050 | HIGH | — | unknown_fix | — | libssh2 - Integer Overflow in publickey Subsystem Attribute Allocation |
| CVE-2026-58051 | HIGH | — | unknown_fix | — | libssh2 - Free of Uninitialized Pointer in publickey List Cleanup |
| CVE-2026-66032 | HIGH | — | unknown_fix | — | libssh2 Double-Free Heap Corruption via sftp_open() |
| CVE-2026-66033 | HIGH | — | unknown_fix | — | libssh2 Integer Underflow DoS via AES-GCM Cipher Negotiation |
| CVE-2026-66034 | HIGH | — | unknown_fix | — | libssh2 Heap Out-of-Bounds Read via publickey subsystem |
| CVE-2026-66035 | HIGH | — | unknown_fix | — | libssh2 Heap Buffer Overflow via ETM Cipher Negotiation |
| OSV-2022-24 | UNKNOWN | — | fixed | — | Null-dereference READ in session_startup |
| OSV-2024-847 | UNKNOWN | — | fixed | — | Null-dereference READ in _libssh2_packet_add |
| OSV-2025-433 | UNKNOWN | — | unfixed_by_design | — | Null-dereference READ in _libssh2_packet_add |
| OSV-2025-90 | UNKNOWN | — | fixed | — | Null-dereference READ in ubsan_GetStackTrace |
| OSV-2025-92 | UNKNOWN | — | fixed | — | Null-dereference READ in session_startup |

## Transitive advisories

2 advisories inherited through runtime dependencies:

- CVE-2026-5435 (HIGH) via glibc
- CVE-2026-6238 (MEDIUM) via glibc

## Dependencies

- Build (7): base, cmake, make, toolchain, pkgconf, openssl, zlib
- Runtime (3): glibc, openssl, zlib

## Scorecard

| Category | Score | Band |
| --- | --- | --- |
| supply-chain | 92 | good |
| advisories | 10 | low |
| quality | 55 | mid |
| maintenance | 100 | perfect |
| licence | 100 | perfect |

## Links

- Homepage: https://libssh2.org/
- Package page (HTML): https://minimal.dev/pkgs/libssh2
- JSON API (floats latest): https://minimal.dev/api/pkgs/libssh2.json
- SBOM (CycloneDX 1.5): https://minimal.dev/api/pkgs/libssh2/sbom.json