CVE-2019-3863
A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side.
Published Mar 25, 2019 · updated Oct 14, 2026 · libssh2 libssh2
A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. A server could send a multiple keyboard interactive response messages whose total length are greater than unsigned char max characters. This value is used by the SSH client as an index to copy memory causing in an out of bounds memory write error.
Timeline
Detection, updates, and resolution for this record.
Mar 25, 2019 · NIST NVD
Detected
A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. A server could send a multiple keyboard interactive response messages whose total length are greater than unsigned char max characters. This value is used by the SSH client as an index to copy memory causing in an out of bounds memory write error.
Oct 14, 2026 · NIST NVD
Updated
A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. A server could send a multiple keyboard interactive response messages whose total length are greater than unsigned char max characters. This value is used by the SSH client as an index to copy memory causing in an out of bounds memory write error.
Affected
- cpe debian/debian linux8.0
- cpe libssh2/libssh2version unspecified
- cpe netapp/ontap select deploy administration utilityversion unspecified
- cpe opensuse/leap15.0
- cpe opensuse/leap42.3
- cpe redhat/enterprise linux desktop7.0
- cpe redhat/enterprise linux server7.0
- cpe redhat/enterprise linux server aus7.6
Sources
- NIST NVDCVE-2019-3863
A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. A server could send a multiple keyboard interactive response messages whose total length are greater than unsigned char max characters. This value is used by the SSH client as an index to co
nvd.nist.gov