CVE-2026-66035: 
NixOS Análisis y mitigación de vulnerabilidades

CVE-2026-66035 is a pre-authentication heap buffer overflow vulnerability in libssh2 through version 1.11.1, affecting the fullpacket() function in src/transport.c during Encrypt-then-MAC (ETM) cipher negotiation. A malicious SSH server can exploit this flaw to corrupt heap metadata in any connecting client before authentication occurs. The vulnerability was reported on July 24, 2026, and fixed in commit 42e33d8. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 7.7 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a heap-based buffer overflow (CWE-122 / CWE-120) in the ETM code path of transport_fullpacket() in src/transport.c. When a malicious SSH server sends a packet with a packet_length smaller than the cipher's block size during ETM cipher negotiation, the function allocates a buffer of packet_length bytes but then copies blocksize - 1 bytes via memcpy, writing beyond the allocated buffer. On 32-bit glibc systems, this overflow writes attacker-controlled bytes into an adjacent heap chunk's SIZE field, enabling tcache bin confusion, overlapping live objects, and ultimately function pointer overwrite — all occurring during the session handshake before any authentication takes place. The fix (commit 42e33d8) adds a lower-bound check requiring p->total_num >= mac_len + 4 + blocksize before proceeding with allocation and decryption (GitHub PR #2198, Patch Commit).

Successful exploitation allows an unauthenticated attacker impersonating an SSH server to achieve arbitrary code execution on the connecting SSH client before authentication occurs. The impact spans full confidentiality, integrity, and availability compromise of the vulnerable client system. Because the overflow occurs during the handshake phase, any application or system using libssh2 ≤ 1.11.1 to connect to SSH servers is at risk, including automated scripts, CI/CD pipelines, and embedded systems — particularly those running 32-bit glibc environments where the heap metadata corruption is most reliably exploitable (GitHub Advisory, Red Hat Bugzilla).

1. Set up a rogue SSH server: The attacker deploys a malicious SSH server (or performs a man-in-the-middle attack) that the victim libssh2 client will connect to, targeting systems running libssh2 ≤ 1.11.1, preferably on 32-bit glibc.
2. Initiate SSH handshake: Wait for or socially engineer a victim client to initiate an SSH connection to the attacker-controlled server.
3. Negotiate ETM cipher: During the SSH key exchange, ensure the server advertises and negotiates an Encrypt-then-MAC cipher suite, which triggers the vulnerable ETM code path in fullpacket().
4. Send malformed packet: Transmit a crafted SSH packet where packet_length is smaller than the cipher's block size. This causes the ETM path in transport_fullpacket() to allocate a buffer of packet_length bytes but copy blocksize - 1 bytes via memcpy.
5. Corrupt heap metadata: The overflow writes attacker-controlled bytes into the adjacent heap chunk's SIZE field, enabling tcache bin confusion on 32-bit glibc.
6. Achieve code execution: Leverage heap exploitation techniques (overlapping live objects, function pointer overwrite) to redirect execution flow and achieve arbitrary code execution on the client before authentication completes (GitHub PR #2198, VulnCheck Advisory).

• Network: Unexpected or anomalous SSH server responses during the handshake phase, particularly from servers not previously connected to; SSH connections to unknown or newly registered IP addresses/hostnames.
• Process: Unusual child processes spawned by applications using libssh2 (e.g., file managers, CI/CD agents, SFTP clients) immediately after an SSH connection attempt; application crashes or segmentation faults during SSH session establishment.
• Logs: Application or system logs showing SSH connection failures or decrypt errors (LIBSSH2_ERROR_DECRYPT) from unexpected servers; core dump files generated by libssh2-linked applications.
• File System: Unexpected new files, scripts, or binaries created shortly after an SSH connection attempt to an untrusted server; modifications to cron jobs or startup scripts by the user account running the libssh2 client.

The primary remediation is to upgrade libssh2 to a version containing commit 42e33d8 or later (post-1.11.1), which adds a bounds check in transport_fullpacket() to validate that the total packet size is sufficient before allocation and decryption (Patch Commit). If immediate patching is not possible, restrict SSH connections to only trusted, verified servers to eliminate the attacker-controlled server precondition. Additionally, disabling Encrypt-then-MAC cipher negotiation in the SSH client configuration (if the implementation permits) can prevent the vulnerable code path from being triggered. Organizations using libssh2 in embedded or 32-bit environments should prioritize patching, as those platforms are most susceptible to reliable exploitation (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was reported by multiple researchers including Vladimir Eli Tokarev, RuiZhi Zhang (Gitee Codepecker Lab), and Hananto Adi, as credited in the libssh2 release notes (GitHub PR #2198). Security news outlets including CyberPress, CyberSecurityNews, and SecurityOnline covered the disclosure, with headlines emphasizing the risk to "millions of SSH connections" and the pre-authentication nature of the flaw (CyberPress, CyberSecurityNews). The Yocto Project security mailing list and NixOS package tracker also flagged the issue for downstream consumers of libssh2. Red Hat opened a tracking bug and is assessing impact across its product portfolio (Red Hat Bugzilla).