Serious libssh2 flaws let rogue SSH servers corrupt client memory

Four new vulnerabilities in libssh2 threaten SSH and SFTP clients, allowing malicious servers to corrupt memory. Disclosed on July 24, 2026, these flaws carry a high severity rating of up to 8.8 on the CVSS scale. Key vulnerabilities include double-free heap corruption and integer underflow. While no exploitation has been confirmed, patches are available. Users are advised to update to specific commits to mitigate risks, and to connect only to trusted SSH servers until updated.