libssh2 (versions 1.11.1 and below)

The packet-parsing code read an attacker-controlled length value from the incoming SSH packet but only rejected values below 1. No upper limit was enforced. When a very large length value is supplied, arithmetic to calculate the required buffer size wraps around to a tiny number (this is an integer overflow — when a number exceeds the maximum a fixed-size counter can hold and loops back to near zero). libssh2 then allocates a small buffer but later writes the full oversized packet into it, writing past the end of that buffer in memory — a heap out-of-bounds write (writing data beyond the boundary of an allocated memory block). The fix adds a single check rejecting any length above the permitted maximum before the arithmetic runs.

An attacker who controls or compromises an SSH server waits for a vulnerable client to connect. During the handshake, the server sends a crafted packet with an oversized length field. libssh2 miscalculates the buffer size, allocates too little memory, and then overwrites adjacent memory. Depending on the application and how libssh2 is embedded, this can lead to code running under that application's privileges. No user interaction is required beyond initiating the connection.

1. Unexplained crashes or memory errors in applications that make SSH connections (curl jobs, Git operations, backup agents)
2. Anomalous outbound connections following an SSH handshake to an external server
3. SSH client processes spawning unexpected child processes or making unusual network connections

1. Inventory every application and appliance that uses libssh2, including statically bundled copies — curl, Git, and PHP deployments are the most common carriers
2. Apply the patch by using distro backports where available (Debian already has a repaired build in testing) or build from source including commit 97acf3d
3. Until patched, restrict outbound SSH connections to trusted, verified servers and confirm host keys are checked before connecting