[CLSA-2026:1791978631] Fix CVE(s): CVE-2026-66032, CVE-2026-66033, CVE-2026-66034, CVE-2026-66035

Type:

security

Severity:

Important

Release date:

2026-10-14 11:50:45 UTC

Description:

   * Fix CVE-2026-66032 (sftp_open double-free of the status buffer),
     CVE-2026-66033 (AES-GCM length underflow in _libssh2_cipher_crypt),
     CVE-2026-66034 (publickey.c comment_len OOB read),
     CVE-2026-66035 (ETM heap overflow in fullpacket)
   * Fix length underflow on short chacha20-poly1305 packets
     (no CVE, GHSA-x4g5-mgfc-cxvv, upstream 15257c08 / #2389)

CVEs fixed:

CVE-2026-66032
CVE-2026-66033
CVE-2026-66034
CVE-2026-66035

Updated packages:

alt-libssh2_1.11.1-1.8_amd64.deb
sha:87a6c87da988132cc7706717b0f9105e1c4505c4
alt-libssh2-dev_1.11.1-1.8_amd64.deb
sha:7aec8e6e88eed09759abfa0a7e93dd09967fd904

Notes:

This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.