[CLSA-2026:1791980643] Fix CVE(s): CVE-2026-66032, CVE-2026-66033, CVE-2026-66034, CVE-2026-66035

Type:

security

Severity:

Important

Release date:

2026-10-14 12:24:17 UTC

Description:

   * Fix CVE-2026-66032 (sftp_open double-free of the status buffer),
     CVE-2026-66033 (AES-GCM length underflow in _libssh2_cipher_crypt),
     CVE-2026-66034 (publickey.c comment_len OOB read),
     CVE-2026-66035 (ETM heap overflow in fullpacket)
   * Fix length underflow on short chacha20-poly1305 packets
     (no CVE, GHSA-x4g5-mgfc-cxvv, upstream 15257c08 / #2389)

CVEs fixed:

Updated packages:

alt-libssh2_1.11.1-1.8_amd64.deb
sha:2628c108a6654dff2fd56dfe594e6ff6aea774d6
alt-libssh2-dev_1.11.1-1.8_amd64.deb
sha:92496c82b9bc3d5c3ba0fb75841ef7ec75c48a30
alt-libssh2_1.11.1-1.8_arm64.deb
sha:d59979658a61924973718f0ddfad4be4b9e5e8f0
alt-libssh2-dev_1.11.1-1.8_arm64.deb
sha:2a7e9c49ee6f694ba03d1e790557d5a7f4eb451d

Notes:

This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.