[CLSA-2026:1791979075] Fix CVE(s): CVE-2026-66032, CVE-2026-66033, CVE-2026-66034, CVE-2026-66035

Type:

security

Severity:

Important

Release date:

2026-10-14 11:58:09 UTC

Description:

   * Fix CVE-2026-66032 (sftp_open double-free of the status buffer),
     CVE-2026-66033 (AES-GCM length underflow in _libssh2_cipher_crypt),
     CVE-2026-66034 (publickey.c comment_len OOB read),
     CVE-2026-66035 (ETM heap overflow in fullpacket)
   * Fix length underflow on short chacha20-poly1305 packets
     (no CVE, GHSA-x4g5-mgfc-cxvv, upstream 15257c08 / #2389)

CVEs fixed:

CVE-2026-66032
CVE-2026-66033
CVE-2026-66034
CVE-2026-66035

Updated packages:

alt-libssh2_1.11.1-1.8_amd64.deb
sha:82b56aad68cc0bef58050461b75bdb05d7237c1b
alt-libssh2-dev_1.11.1-1.8_amd64.deb
sha:73741fb7bb2d800b9f3810fd2d087fea42605180

Notes:

This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.