CVE-2026-66033: 
NixOS Análisis y mitigación de vulnerabilidades

CVE-2026-66033 is a pre-authentication integer underflow vulnerability in libssh2 through version 1.11.1, affecting the ssh2_cipher_crypt() function in src/openssl.c. A malicious SSH server can crash any connecting libssh2 client by negotiating AES-GCM ciphers during the SSH handshake, before any authentication occurs. The vulnerability was reported by Vladimir Eli Tokarev, disclosed on July 24, 2026, and fixed in commit a2ed82d. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (Github Advisory, Red Hat Bugzilla).

The root cause is an integer underflow (CWE-191) combined with an out-of-bounds read (CWE-125) in the ssh2_cipher_crypt() function within src/openssl.c. In non-debug builds, the expression cryptlen = blocksize - aadlen - authenticationtag was computed without bounds validation; if aadlen + authenticationtag exceeds blocksize (as can be arranged by a malicious server negotiating AES-GCM), the unsigned subtraction wraps around to a near-SIZE_MAX value. This causes a subsequent memcpy call with a near-SIZE_MAX length argument, triggering an out-of-bounds read and immediate process crash. The fix (PR #2401, commit a2ed82d) adds two runtime bounds checks — verifying that blocksize fits within the local stack buffer and that blocksize >= aadlen + authenticationtag — before computing cryptlen (libssh2 PR #2401, libssh2 commit a2ed82d).

Successful exploitation results in an immediate crash of the libssh2 client process before authentication completes, causing a denial of service (CWE-125/CWE-191). There is no confidentiality or integrity impact — the vulnerability is purely an availability issue. Any application or system using libssh2 ≤ 1.11.1 to initiate SSH connections is at risk; this includes automated scripts, CI/CD pipelines, file transfer tools, and embedded systems that rely on libssh2 as their SSH client library (Github Advisory, Red Hat Bugzilla).

1. Set up a malicious SSH server: The attacker deploys a rogue SSH server (e.g., a modified OpenSSH or custom implementation) configured to advertise and negotiate AES-GCM ciphers during the SSH handshake.
2. Lure or intercept the target client: The attacker either tricks a libssh2-based client into connecting to the malicious server (e.g., via DNS spoofing, BGP hijacking, phishing, or a man-in-the-middle position), or operates a service that clients are expected to connect to.
3. Negotiate AES-GCM cipher: During the SSH key exchange (SSH_MSG_KEXINIT), the malicious server ensures AES-GCM is selected as the cipher, which activates the vulnerable AES-GCM code path in ssh2_cipher_crypt().
4. Trigger the integer underflow: The server sends crafted cipher parameters such that aadlen + authenticationtag > blocksize, causing the unsigned subtraction in cryptlen = blocksize - aadlen - authenticationtag to wrap around to a near-SIZE_MAX value.
5. Crash the client: The resulting near-SIZE_MAX value is passed as the length argument to memcpy, triggering an out-of-bounds read and immediate process crash of the libssh2 client — all before any authentication occurs (libssh2 PR #2401, Github Advisory).

• Network: Unexpected or anomalous SSH connection attempts from client systems to unknown or untrusted SSH server IP addresses; SSH handshake traffic that terminates abruptly without completing authentication.
• Logs: Application or system logs showing sudden crashes or segmentation faults in processes using libssh2 (e.g., libssh2-linked binaries such as curl, rsync, custom SSH clients) during connection establishment; SSH client error messages referencing cipher negotiation failure or AES-GCM.
• Process: Unexpected termination (exit code indicating signal, e.g., SIGSEGV or SIGABRT) of processes that use libssh2 immediately after initiating an SSH connection, with no authentication-phase log entries.
• File System: Core dump files generated by libssh2-linked processes in /var/crash/, /tmp/, or the working directory of the affected application, with stack traces pointing to ssh2_cipher_crypt() in src/openssl.c.

The fix is available in libssh2 commit a2ed82d40964bbc0d64cd717aa0a5a892117d2e6 (merged July 24, 2026); users should update to any libssh2 release that includes this commit. Red Hat has issued errata RHSA-2026:46927 for affected Red Hat products (Red Hat Errata). As a temporary workaround until patching is possible, restrict libssh2-based clients to connect only to trusted, known-good SSH servers, and if the library's configuration permits, disable AES-GCM cipher support to prevent the vulnerable code path from being triggered (Github Advisory, Red Hat Bugzilla).

Security media covered the vulnerability as part of a broader set of libssh2 flaws disclosed in late July 2026, with outlets such as CyberPress, SecurityOnline, and CyberSecurityNews highlighting the risk to SSH clients before authentication (CyberPress, SecurityOnline, CyberSecurityNews). The Yocto Project security mailing list also flagged the issue for embedded Linux users (Yocto Security List). VulnCheck, which assigned the CVE, published a dedicated advisory describing the integer underflow DoS mechanism (VulnCheck Advisory). Community reaction has been moderate, with downstream projects such as NixOS and Debian tracking the issue for package updates.