{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\nlibssh2:\n  * libssh2-1.11.1-10.2.hum1 (aarch64, x86_64)\n  * libssh2-devel-1.11.1-10.2.hum1 (aarch64, x86_64)\n  * libssh2-docs-1.11.1-10.2.hum1 (noarch)\n  * libssh2-1.11.1-10.2.hum1.src (src)\n\nSecurity Fix(es):\n\nlibssh2:\n  * CVE-2026-58051\n  * CVE-2026-66032",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:46927",
        "url": "https://access.redhat.com/errata/RHSA-2026:46927"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-58051",
        "url": "https://access.redhat.com/security/cve/CVE-2026-58051"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-66032",
        "url": "https://access.redhat.com/security/cve/CVE-2026-66032"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-66034",
        "url": "https://access.redhat.com/security/cve/CVE-2026-66034"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-66033",
        "url": "https://access.redhat.com/security/cve/CVE-2026-66033"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_46927.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
    "tracking": {
      "current_release_date": "2026-07-27T20:43:03+00:00",
      "generator": {
        "date": "2026-07-27T20:43:03+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.7"
        }
      },
      "id": "RHSA-2026:46927",
      "initial_release_date": "2026-07-27T18:20:38+00:00",
      "revision_history": [
        {
          "date": "2026-07-27T18:20:38+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-07-27T20:33:58+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-07-27T20:43:03+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libssh2-main@aarch64",
                "product": {
                  "name": "libssh2-main@aarch64",
                  "product_id": "libssh2-main@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libssh2@1.11.1-10.2.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libssh2-main@src",
                "product": {
                  "name": "libssh2-main@src",
                  "product_id": "libssh2-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libssh2@1.11.1-10.2.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libssh2-main@x86_64",
                "product": {
                  "name": "libssh2-main@x86_64",
                  "product_id": "libssh2-main@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libssh2@1.11.1-10.2.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libssh2-main@noarch",
                "product": {
                  "name": "libssh2-main@noarch",
                  "product_id": "libssh2-main@noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libssh2-docs@1.11.1-10.2.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libssh2-main@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:libssh2-main@aarch64"
        },
        "product_reference": "libssh2-main@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libssh2-main@noarch as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:libssh2-main@noarch"
        },
        "product_reference": "libssh2-main@noarch",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libssh2-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:libssh2-main@src"
        },
        "product_reference": "libssh2-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libssh2-main@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:libssh2-main@x86_64"
        },
        "product_reference": "libssh2-main@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-58051",
      "cwe": {
        "id": "CWE-824",
        "name": "Access of Uninitialized Pointer"
      },
      "discovery_date": "2026-06-28T03:01:08.381727+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2493950"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw in libssh2 allows a malicious SSH server to send a malformed public key response, triggering an invalid memory cleanup. This can cause the connecting client application to crash or leak information.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libssh2: libssh2: Denial of service or information disclosure via malformed SSH publickey response",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Moderate: This flaw in libssh2 can lead to a denial of service or information disclosure in client applications when connecting to a malicious SSH server. The vulnerability arises from improper handling of uninitialized memory during public key list processing, which an attacker can trigger with a specially crafted response. Exploitation requires active interaction with a compromised or malicious server, limiting the attack surface to untrusted connections.\n\nNote: Red Hat Enterprise Linux (RHEL) 8 and newer are not affected by this flaw, as they do not ship the libssh2 package.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:libssh2-main@aarch64",
          "Red Hat Hardened Images:libssh2-main@noarch",
          "Red Hat Hardened Images:libssh2-main@src",
          "Red Hat Hardened Images:libssh2-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-58051"
        },
        {
          "category": "external",
          "summary": "RHBZ#2493950",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493950"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-58051",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-58051"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58051",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58051"
        },
        {
          "category": "external",
          "summary": "https://github.com/bikini/exploitarium/tree/main/libssh2-publickey-list-calc-poc",
          "url": "https://github.com/bikini/exploitarium/tree/main/libssh2-publickey-list-calc-poc"
        },
        {
          "category": "external",
          "summary": "https://github.com/libssh2/libssh2/blob/master/src/publickey.c",
          "url": "https://github.com/libssh2/libssh2/blob/master/src/publickey.c"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/libssh2-free-of-uninitialized-pointer-in-publickey-list-cleanup",
          "url": "https://www.vulncheck.com/advisories/libssh2-free-of-uninitialized-pointer-in-publickey-list-cleanup"
        }
      ],
      "release_date": "2026-06-28T01:32:54.283000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-27T18:20:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:libssh2-main@aarch64",
            "Red Hat Hardened Images:libssh2-main@noarch",
            "Red Hat Hardened Images:libssh2-main@src",
            "Red Hat Hardened Images:libssh2-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:46927"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, ensure your applications connect only to trusted and verified SSH servers. For added protection, maintain standard system memory defenses to automatically intercept and safely terminate any processes corrupted by an unexpected server error.",
          "product_ids": [
            "Red Hat Hardened Images:libssh2-main@aarch64",
            "Red Hat Hardened Images:libssh2-main@noarch",
            "Red Hat Hardened Images:libssh2-main@src",
            "Red Hat Hardened Images:libssh2-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:libssh2-main@aarch64",
            "Red Hat Hardened Images:libssh2-main@noarch",
            "Red Hat Hardened Images:libssh2-main@src",
            "Red Hat Hardened Images:libssh2-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libssh2: libssh2: Denial of service or information disclosure via malformed SSH publickey response"
    },
    {
      "cve": "CVE-2026-66032",
      "cwe": {
        "id": "CWE-1341",
        "name": "Multiple Releases of Same Resource or Handle"
      },
      "discovery_date": "2026-07-24T17:03:22.604828+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2506857"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libssh2. A malicious SSH (Secure Shell) server can exploit a double-free vulnerability in the sftp_open() function. This flaw allows the server to corrupt the heap memory of an authenticated client when it opens an SFTP (SSH File Transfer Protocol) session. This heap corruption can lead to arbitrary code execution on the client system, giving the attacker control over the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libssh2: libssh2: Arbitrary code execution via double-free in SFTP session",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Moderate: A double-free vulnerability in libssh2 allows a malicious SSH server to corrupt the heap of an authenticated client during an SFTP session. This flaw requires user interaction, as a client must connect to a specially crafted server and initiate an SFTP transfer, which can lead to arbitrary code execution on the client system.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:libssh2-main@aarch64",
          "Red Hat Hardened Images:libssh2-main@noarch",
          "Red Hat Hardened Images:libssh2-main@src",
          "Red Hat Hardened Images:libssh2-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-66032"
        },
        {
          "category": "external",
          "summary": "RHBZ#2506857",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506857"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-66032",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-66032"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66032",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66032"
        },
        {
          "category": "external",
          "summary": "https://github.com/libssh2/libssh2/commit/5e4776146552d898b9c0e1b313cd093fa8dc92d0",
          "url": "https://github.com/libssh2/libssh2/commit/5e4776146552d898b9c0e1b313cd093fa8dc92d0"
        },
        {
          "category": "external",
          "summary": "https://github.com/libssh2/libssh2/pull/2180",
          "url": "https://github.com/libssh2/libssh2/pull/2180"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/libssh2-double-free-heap-corruption-via-sftp-open",
          "url": "https://www.vulncheck.com/advisories/libssh2-double-free-heap-corruption-via-sftp-open"
        }
      ],
      "release_date": "2026-07-24T16:32:39.596000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-27T18:20:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:libssh2-main@aarch64",
            "Red Hat Hardened Images:libssh2-main@noarch",
            "Red Hat Hardened Images:libssh2-main@src",
            "Red Hat Hardened Images:libssh2-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:46927"
        },
        {
          "category": "workaround",
          "details": "Restrict your libssh2 clients to connect only to fully trusted, internal SFTP servers to eliminate exposure to malicious server responses. Additionally, configure dependent applications with Restart=on-failure in systemd so RHEL\u0027s glibc memory protections can safely crash and auto-recover the process during an attack.",
          "product_ids": [
            "Red Hat Hardened Images:libssh2-main@aarch64",
            "Red Hat Hardened Images:libssh2-main@noarch",
            "Red Hat Hardened Images:libssh2-main@src",
            "Red Hat Hardened Images:libssh2-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:libssh2-main@aarch64",
            "Red Hat Hardened Images:libssh2-main@noarch",
            "Red Hat Hardened Images:libssh2-main@src",
            "Red Hat Hardened Images:libssh2-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libssh2: libssh2: Arbitrary code execution via double-free in SFTP session"
    },
    {
      "cve": "CVE-2026-66033",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-07-24T17:02:07.705337+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2506853"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libssh2. A pre-authentication integer underflow vulnerability exists in the `ssh2_cipher_crypt()` function when negotiating AES-GCM ciphers during the handshake. A malicious SSH server can exploit this to trigger an out-of-bounds read and a memory copy operation with an extremely large length argument, leading to an immediate client process crash. This vulnerability results in a Denial of Service (DoS) for any connecting client.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libssh2: libssh2: Denial of Service via integer underflow in AES-GCM cipher negotiation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact flaw in libssh2 allows a malicious SSH server to trigger a client-side denial of service. The vulnerability, an integer underflow during AES-GCM cipher negotiation, can cause a connecting client to crash before authentication. Exploitation requires the client to connect to a specially crafted, untrusted SSH server.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:libssh2-main@aarch64",
          "Red Hat Hardened Images:libssh2-main@noarch",
          "Red Hat Hardened Images:libssh2-main@src",
          "Red Hat Hardened Images:libssh2-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-66033"
        },
        {
          "category": "external",
          "summary": "RHBZ#2506853",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506853"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-66033",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-66033"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66033",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66033"
        },
        {
          "category": "external",
          "summary": "https://github.com/libssh2/libssh2/commit/a2ed82d40964bbc0d64cd717aa0a5a892117d2e6",
          "url": "https://github.com/libssh2/libssh2/commit/a2ed82d40964bbc0d64cd717aa0a5a892117d2e6"
        },
        {
          "category": "external",
          "summary": "https://github.com/libssh2/libssh2/pull/2401",
          "url": "https://github.com/libssh2/libssh2/pull/2401"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/libssh2-integer-underflow-dos-via-aes-gcm-cipher-negotiation",
          "url": "https://www.vulncheck.com/advisories/libssh2-integer-underflow-dos-via-aes-gcm-cipher-negotiation"
        }
      ],
      "release_date": "2026-07-24T16:35:28.607000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-27T18:20:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:libssh2-main@aarch64",
            "Red Hat Hardened Images:libssh2-main@noarch",
            "Red Hat Hardened Images:libssh2-main@src",
            "Red Hat Hardened Images:libssh2-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:46927"
        },
        {
          "category": "workaround",
          "details": "To mitigate the vulnerability, developers or administrators must configure the specific applications utilizing libssh2 to explicitly exclude AES-GCM from their preferred cipher lists.",
          "product_ids": [
            "Red Hat Hardened Images:libssh2-main@aarch64",
            "Red Hat Hardened Images:libssh2-main@noarch",
            "Red Hat Hardened Images:libssh2-main@src",
            "Red Hat Hardened Images:libssh2-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:libssh2-main@aarch64",
            "Red Hat Hardened Images:libssh2-main@noarch",
            "Red Hat Hardened Images:libssh2-main@src",
            "Red Hat Hardened Images:libssh2-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libssh2: libssh2: Denial of Service via integer underflow in AES-GCM cipher negotiation"
    },
    {
      "cve": "CVE-2026-66034",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-07-24T17:03:46.498702+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2506860"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A missing bounds check in the libssh2 publickey subsystem allows malicious SSH servers to trigger a client-side out-of-bounds read, leaking heap pointers that could enable security bypasses, denial of service, or code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libssh2: libssh2: Information disclosure and potential arbitrary code execution via heap out-of-bounds read",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact flaw in libssh2 allows a malicious SSH server to trigger an out-of-bounds read on a connecting client. While requiring user interaction to connect to a compromised server and having high attack complexity, successful exploitation could leak heap pointers, potentially aiding in ASLR bypass and leading to arbitrary code execution or denial of service on Red Hat Hardened Images.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:libssh2-main@aarch64",
          "Red Hat Hardened Images:libssh2-main@noarch",
          "Red Hat Hardened Images:libssh2-main@src",
          "Red Hat Hardened Images:libssh2-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-66034"
        },
        {
          "category": "external",
          "summary": "RHBZ#2506860",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506860"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-66034",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-66034"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66034",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66034"
        },
        {
          "category": "external",
          "summary": "https://github.com/libssh2/libssh2/commit/a13bb6c773f0d55ad1628cede57e99803cd898d9",
          "url": "https://github.com/libssh2/libssh2/commit/a13bb6c773f0d55ad1628cede57e99803cd898d9"
        },
        {
          "category": "external",
          "summary": "https://github.com/libssh2/libssh2/pull/2202",
          "url": "https://github.com/libssh2/libssh2/pull/2202"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/libssh2-heap-out-of-bounds-read-via-publickey-subsystem",
          "url": "https://www.vulncheck.com/advisories/libssh2-heap-out-of-bounds-read-via-publickey-subsystem"
        }
      ],
      "release_date": "2026-07-24T16:42:18.764000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-27T18:20:38+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:libssh2-main@aarch64",
            "Red Hat Hardened Images:libssh2-main@noarch",
            "Red Hat Hardened Images:libssh2-main@src",
            "Red Hat Hardened Images:libssh2-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:46927"
        },
        {
          "category": "workaround",
          "details": "To mitigate this, strictly avoid connecting to untrusted SSH servers and enforce this policy using outbound network firewalls to block unknown IP addresses. For defense-in-depth, utilize OS-level memory protections and service sandboxing to contain any accidental exposure.",
          "product_ids": [
            "Red Hat Hardened Images:libssh2-main@aarch64",
            "Red Hat Hardened Images:libssh2-main@noarch",
            "Red Hat Hardened Images:libssh2-main@src",
            "Red Hat Hardened Images:libssh2-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:libssh2-main@aarch64",
            "Red Hat Hardened Images:libssh2-main@noarch",
            "Red Hat Hardened Images:libssh2-main@src",
            "Red Hat Hardened Images:libssh2-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libssh2: libssh2: Information disclosure and potential arbitrary code execution via heap out-of-bounds read"
    }
  ]
}