CVE-2019-17498 — In libssh2 v1

In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive inf

01What is this vulnerability?

In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server.

02Affected products

No structured affected-product list available — see references below for vendor advisories.

03Active exploitation status

Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.

04Recommended remediation

• Patch to a fixed version listed in the vendor advisory (see references below).
• Mitigate with WAF rules, network egress filters, or feature flags where the patch is not yet available.
• Hunt historical logs for exploitation indicators — see Detection signatures below.

05Technical details

For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.

06Detection signatures

Ask SARA in chat to draft a starting detection for this CVE in your stack of choice.

07Related CVEs

No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.

08Timeline

• Published: 2019-10-21T22:15:10.523
• Last modified: 2026-10-14T07:16:48.780

09References

• lists.opensuse.org — http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00026.html
• packetstormsecurity.com — http://packetstormsecurity.com/files/172835/libssh2-1.9.0-Out-Of-Bounds-Read.htm…
• blog.semmle.com — https://blog.semmle.com/libssh2-integer-overflow-CVE-2019-17498/
• github.com — https://github.com/kevinbackhouse/SecurityExploits/tree/8cbdbbe6363510f7d9ceec68…
• github.com — https://github.com/libssh2/libssh2/blob/42d37aa63129a1b2644bf6495198923534322d64…
• github.com — https://github.com/libssh2/libssh2/commit/dedcbd106f8e52d5586b0205bc7677e4c9868f…
• lists.debian.org — https://lists.debian.org/debian-lts-announce/2019/11/msg00010.html
• lists.debian.org — https://lists.debian.org/debian-lts-announce/2021/12/msg00013.html
• lists.debian.org — https://lists.debian.org/debian-lts-announce/2023/09/msg00006.html
• lists.fedoraproject.org — https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro…