CVE-2026-66033

Executive Summary

CVE-2026-66033 describes a pre‑authentication integer underflow vulnerability in libssh2, an SSH2 protocol implementation used by many client applications (e.g., cURL, Git, OpenSSH after forking libssh2 components). The flaw resides in the ssh2_cipher_crypt() function in src/openssl.c. When a malicious SSH server negotiates AES‑GCM ciphers during the handshake, an integer underflow occurs in the computation blocksize - aadlen - authentication_tag_length. This underflow leads to an out‑of‑bounds read and a memcpy() call with a near‑SIZE_MAX length argument, causing an immediate crash of the connecting client before any authentication takes place.

While no public proof‑of‑concept or exploit has been released, any libssh2‑based client connecting to a malicious SSH server that offers AES‑GCM is vulnerable. The attack requires no user interaction beyond initiating the connection. Despite a CVSS score of 7.5 (High), the impact is limited to denial of service (client crash), with no confidentiality or integrity compromise. The vendor has not yet released a patched version; only a source‑level commit exists. Immediate remediation involves disabling AES‑GCM cipher negotiation in the client or applying the commit.

CVSS Breakdown & Threat Level

• Base Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • Attack Vector: Network (malicious SSH server reachable over network)
  • Attack Complexity: Low (no special conditions)
  • Privileges Required: None
  • User Interaction: None (automated or forced connection)
  • Scope: Unchanged
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High (process crash)
• Threat Rating: High – Affects every libssh2 client; easily triggerable by a rogue SSH server during handshake.

Deep Dive & Mechanics

The vulnerability is found in src/openssl.c in the function ssh2_cipher_crypt(), which is called during SSH protocol negotiation to process encrypted packets. The code calculates a length variable as:

len = blocksize - aadlen - authentication_tag_length;

When AES‑GCM ciphers (e.g., aes128-gcm@openssh.com, aes256-gcm@openssh.com) are negotiated, aadlen and authentication_tag_length are set to 12 and 16 bytes, respectively, while blocksize is 16 bytes. The operation 16 - 12 - 16 yields -12, which, being an unsigned integer, wraps to SIZE_MAX - 11 (a value near the maximum). This huge length is then used in:

• An out‑of‑bounds read when copying from a buffer into another.
• A memcpy() call with len as the copy size, causing a massive copy that almost immediately segfaults or triggers an access violation.

The crash occurs before any SSH authentication, meaning no credentials are at risk, but the client process is killed. This makes it a classic pre‑auth denial‑of‑service vector.

Vulnerable vs. Patched Code

Vulnerable code (libssh2 ≤ 1.11.1):

// src/openssl.c – ssh2_cipher_crypt()
len = blocksize - aadlen - authentication_tag_length;
// ...
memcpy(dest, src, len);   // len may be huge

Patched code (commit a2ed82d):

// Check for underflow before proceeding
if (blocksize < (aadlen + authentication_tag_length)) {
    return LIBSSH2_ERROR_PROTO;
}
len = blocksize - aadlen - authentication_tag_length;
// ...

The patch adds a guard to ensure blocksize - aadlen - authentication_tag_length does not underflow, returning a protocol error instead of proceeding.

Exploitation & Lab Setup

Red Team

As no public exploit exists, a proof‑of‑concept can be built from scratch:

1. Setup a malicious SSH server (e.g., using Python's paramiko or a custom TCP server) that responds to client key exchange with AES‑GCM cipher announcements.
2. Craft a KEX_INIT packet that advertises aes128-gcm@openssh.com as the preferred encryption algorithm.
3. When the client sends its first encrypted packet (NEWKEYS), the server sends a dummy encrypted packet (or waits for client to send one). The client's ssh2_cipher_crypt() will underflow and crash.
4. Impact: All libssh2‑based applications (curl, git, custom SSH clients) connecting to the rogue server will crash immediately.

Reminder: No authentication step is reached, so no credentials are obtained. The attack is purely DoS.

Blue Team

• Detection: Monitor for SSH handshake attempts that only negotiate AES‑GCM ciphers and then connection tears down abnormally (no further traffic).
• Mitigation:
  • Disable AES‑GCM cipher in libssh2 client configuration if patch is not available.
  • Alternatively, apply the commit a2ed82d from the libssh2 repository and rebuild.
• Hunting: Search for crash logs in client applications that match the pattern:

  libssh2: ssh2_cipher_crypt: out of memory / crash
  

  or SIGSEGV in libssh2 context.

Indicators of Compromise (IOCs)

• Network:
  • SSH handshake where the server offers any of the following KEX algorithms: aes128-gcm@openssh.com, aes256-gcm@openssh.com (legitimate servers often do, but combined with a subsequent crash).
  • Connection terminated immediately after KEX_INIT without proceeding to userauth.
• File / Process:
  • Crash dumps (core files) from libssh2.so.1 or libssh2.dll.
  • Log entries: (libssh2) ssh2_cipher_crypt failed.
• Behavioral:
  • Client connection to a known‑malicious SSH IP that returns only AES‑GCM in the cipher list (anomalous).

Detection Engineering

YARA Rule

rule libssh2_cve_2026_66033_crash {
    meta:
        description = "Detects crash artifacts from CVE-2026-66033 libssh2 integer underflow"
        author = "Valters IT CTI"
        reference = "CVE-2026-66033"
    strings:
        $crash_log = /ssh2_cipher_crypt.*memcpy.*SIZE_MAX/ nocase
        $version_string = "libssh2 1.11.1" ascii
    condition:
        $crash_log or $version_string
}

Sigma Rule

title: libssh2 Pre-Auth Integer Underflow (CVE-2026-66033)
id: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
status: experimental
description: Detects SSH client crashes caused by CVE-2026-66033 exploitation attempt
logsource:
    category: process_creation
    product: windows
    service: null
detection:
    selection:
        - EventID: 4688   # Windows process creation
        - CommandLine|contains: 'ssh'  # Adjust to application name (curl, git, etc.)
        - Image|endswith: '.exe' 
    condition: selection
falsepositives:
    - Other SSH client crashes
level: high
tags:
    - attack.t1499
    - cve.2026.66033

Suricata Rule

alert tcp any any -> any 22 (msg:"CVE-2026-66033 libssh2 Pre-Auth AES-GCM Crash Attempt"; flow:to_server,established; content:"|00 00 00 0c|"; depth:4; content:"|61 65 73 31 32 38 2d 67 63 6d 40 6f 70 65 6e 73 73 68 2e 63 6f 6d|"; within:100; sid:1000001; rev:1;)

Note: The Suricata rule above detects AES-GCM cipher advertisement; alerts should be correlated with subsequent connection drops.

Remediation & Mitigation

1. Apply patch: Apply commit a2ed82d from the libssh2 repository (or wait for official release >1.11.1).
2. Disable AES‑GCM ciphers in client configuration:
   • For libssh2: use LIBSSH2_CFLAG_CIPHER_CS without AES-GCM.
   • For applications like cURL: use --ciphers option to exclude GCM modes.
3. Network segmentation: Do not allow outbound SSH to untrusted servers from critical assets.
4. Monitor logs: Look for repeated SSH crash events; block the offending IP if known malicious.
5. Use alternative SSH libraries: Consider using OpenSSH’s own libcrypto directly instead of libssh2.

Report generated by Valters IT Security Cyber Threat Intelligence