[CLSA-2026:1791981329] Fix CVE(s): CVE-2026-66032, CVE-2026-66033, CVE-2026-66034, CVE-2026-66035

Type:

security

Severity:

Important

Release date:

2026-10-14 12:35:44 UTC

Description:

   * Fix CVE-2026-66032 (sftp_open double-free of the status buffer),
     CVE-2026-66033 (AES-GCM length underflow in _libssh2_cipher_crypt),
     CVE-2026-66034 (publickey.c comment_len OOB read),
     CVE-2026-66035 (ETM heap overflow in fullpacket)
   * Fix length underflow on short chacha20-poly1305 packets
     (no CVE, GHSA-x4g5-mgfc-cxvv, upstream 15257c08 / #2389)

CVEs fixed:

Updated packages:

alt-libssh2_1.11.1-1.8_amd64.deb
sha:67920a685750b312c2da709ff4abc1cb8a7b2dde
alt-libssh2-dev_1.11.1-1.8_amd64.deb
sha:f5b0eeb39e8a6722173d01287125b4df0453dd06
alt-libssh2_1.11.1-1.8_arm64.deb
sha:8316c11eb5fffc88d3284978b506fde4c11b92e6
alt-libssh2-dev_1.11.1-1.8_arm64.deb
sha:e33b9f1374ec8996cbb5512d06e5e8a8b9d271c0

Notes:

This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.