Veille CVE

Jeudi 22 octobre 2026

2 CVE

Critique 0 Élevée 1 Moyenne 0 Faible 0 Non évaluée 1 Exploitées (KEV) Tri : plus récentes « libssh2 » ✕
  1. CVE-2026-55200 8.3 Élevée

    libssh2 · Libssh2 libssh2

    libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.

  2. CVE-2026-87865 – Non évaluée

    curl

    When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to report a key *mismatch* as a *missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback.