SKYLINE Blog

Security advisory Debian

libssh and libssh2 security updates for Debian 12 and 13 (DSA-6410-1, DLA-4844-1, DSA-6365-1, DLA-4773-1)

Debian fixed many libssh and libssh2 flaws in 2026. They are not OpenSSH, but curl, PHP ssh2 and QEMU use them. Versions to check and how to update.

Published
Reading time
5 min read

Security advisory Vulnerability

Severity: High Status: Patched
CVE IDs
Status
Fixed versions are available for Debian 13 (trixie) and Debian 12 (bookworm).
Affected
  • libssh in Debian 13 (trixie) before 0.11.5-0+deb13u1
  • libssh in Debian 12 (bookworm) before 0.10.6-0+deb12u3
  • libssh2 in Debian 13 (trixie) before 1.11.1-1+deb13u1
  • libssh2 in Debian 12 (bookworm) before 1.10.0-3+deb12u1
Published
Updated

What you should do

  • Install the fixed libssh and libssh2 packages on every Debian 12 and 13 system, even if you never use them directly.
  • Restart services that load them, particularly PHP-FPM and backup or deployment tools that connect to remote SFTP servers.
  • Be careful when your applications connect to SSH/SFTP servers you do not control; most of these flaws are triggered by the server side.
  • If you run an SFTP server built on libssh on Debian 13, confirm it uses 0.11.5-0+deb13u1 or later before exposing it to users.
Timeline
  1. Debian published DSA-6365-1 for libssh2.
  2. Debian published DSA-6410-1 for libssh.
  3. The Debian LTS team published DLA-4773-1 for libssh2.
  4. The Debian LTS team published DLA-4844-1 for libssh.
  5. Skyline published this summary.

Debian published four advisories in 2026 for two SSH libraries: libssh (DSA-6410-1 for Debian 13 on 2 August, DLA-4844-1 for Debian 12 on 20 October) and libssh2 (DSA-6365-1 for Debian 13 on 25 June, DLA-4773-1 for Debian 12 on 5 September). Neither library is OpenSSH: your sshd server and the ssh command come from openssh-server and openssh-client, which do not depend on them. The risk sits in programs that embed these libraries to make SSH or SFTP connections, mostly as clients talking to a server that could be malicious.

At a glance

LibraryDebian 13 (trixie)Debian 12 (bookworm)Binary packages
libssh0.11.5-0+deb13u1 (DSA-6410-1, 15 CVEs in the announcement)0.10.6-0+deb12u3 (DLA-4844-1, 13 CVEs)libssh-4; bookworm also libssh-gcrypt-4
libssh21.11.1-1+deb13u1 (DSA-6365-1, 4 CVEs), then 1.11.1-1+deb13u2 in the regular trixie archive1.10.0-3+deb12u1 (DLA-4773-1, 6 CVEs)libssh2-1t64 (trixie), libssh2-1 (bookworm)

Severity: High overall, based on the CNA scores for libssh2 (CVSS 3.1 of 8.8 for CVE-2026-66032 and 8.1 for CVE-2026-55200). libssh's own advisories score its issues at most 6.7. None of these CVEs is in the CISA Known Exploited Vulnerabilities catalog as of 30 October 2026.

What the vulnerabilities are

libssh

Debian describes the libssh issues as possibly leading to "denial of service, information disclosure and potentially the execution of arbitrary code". The main ones, from the libssh advisories and DLA-4844-1:

  • CVE-2026-15370 (trixie only): a possible stack buffer overflow in libssh's SFTP server when listing a directory with very long file names that an attacker controls, which libssh says could lead to code execution. It affects libssh 0.11.0 and later, so bookworm's 0.10.6 is not affected.
  • CVE-2026-0964: a malicious SCP server can send a path that escapes the working directory.
  • CVE-2026-59847: with the OpenSSL backend, a failed AES-GCM tag check could be treated as success, allowing silent modification of data.
  • CVE-2026-59850: data arriving on a remotely closed channel could reach a callback after the channel was freed.
  • Several denial-of-service and parsing bugs, such as CVE-2026-0966, CVE-2026-59843 and CVE-2026-59844. CVE-2026-59849 (an infinite loop with certificate authentication) affects trixie only.

libssh2

libssh2 is a client-side library, so these flaws are triggered by a malicious server or a man in the middle. Debian says they "could result in memory disclosure, denial of service or potentially the execution of arbitrary code".

  • CVE-2026-55200 (trixie only): an out-of-bounds heap write when reading SSH packets with a huge length field. The Debian tracker marks bookworm as not affected.
  • CVE-2026-66032: a double free in sftp_open() reachable from a malicious server during SFTP setup.
  • CVE-2026-66034, CVE-2026-58050, CVE-2026-58051: memory errors in the publickey subsystem.
  • CVE-2025-15661, CVE-2026-7598, CVE-2026-55199: a heap over-read in SFTP symlink handling, an integer overflow in password authentication, and a CPU loop from a crafted extension count (the last is trixie only).

DSA-6365-1 fixed the first group for trixie in June. The four publickey and SFTP fixes from DLA-4773-1 reached trixie later as 1.11.1-1+deb13u2 in the regular stable archive rather than through a DSA, so make sure your trixie sources include the main trixie suite as well as trixie-security.

Are you affected?

On Debian 13, libcurl4t64 and libcurl3t64-gnutls (and therefore curl, PHP's curl extension and git over HTTPS) depend on libssh2-1t64; on Debian 12, libcurl4 depends on libssh2-1. PHP's ssh2 extension also uses libssh2, and QEMU's qemu-block-extra uses libssh. Check what you have:

dpkg -l 'libssh-*' 'libssh2-*'
apt policy libssh-4 libssh2-1t64   # Debian 13
apt policy libssh-4 libssh2-1      # Debian 12

Compare with the versions in the table. Debian 11 (bullseye) is past the end of LTS (31 August 2026) and should be upgraded.

How to update

sudo apt update
sudo apt upgrade

Ubuntu packages differ; check Ubuntu Security Notices.

Restart or reboot?

No reboot is needed. Programs that loaded the old library keep it until restarted. One-off commands such as curl or git pick up the fix on their next run; long-running services, for example PHP-FPM with the ssh2 or curl extension, need a restart:

sudo needrestart -r l
sudo systemctl restart php8.4-fpm

Sources

Topics

SKYLINE Engineering

@skyline

The engineering team at SKYLINE Industrial Solutions. We publish field-tested guides drawn from real KSA and GCC deployments.

See author profile
More in Debian

Related: Skyline Nexus ERP guides

Nexus knowledge base →
Skyline Nexus ERP

Gulf & Middle East tax and e-invoicing guides

VAT, ZATCA e-invoicing and corporate tax explained for Saudi Arabia, the UAE and the wider GCC.

 Skyline Nexus ERP

Skyline Nexus ERP — cloud accounting & ZATCA e-invoicing

Our cloud ERP: accounting, invoicing, inventory and POS in one place. First month free.
SKYLINE engineering services

Need this implemented for you?

Reading is free — building it right takes a team. SKYLINE engineers ship Debian for Aramco vendors, banks, hospitals and government agencies across Saudi Arabia. Talk to us before you start.

Server Infrastructure Dell, HPE, Huawei, VMware, Hyper-V, HCI IT AMC Annual maintenance, 24/7 SLA, Bronze→Platinum
Talk to a SKYLINE engineer Call +966 50 993 9334
Aramco Approved Contractor ISO 9001 · ISO 27001 SAMA CSF aligned NCA ECC ready 247+ KSA clients

Comments

0 total · 0 threads
Be the first to leave a comment.