CVE and update status of the FreeBSD ports tree3,864 unaddressed CVEs in 671 portsAll times are CET
Port details

security/libssh2 1.11.1_1,3

Library implementing the SSH2 protocol

Port info

Maintainer
sbz@FreeBSD.org
Packages
latest: 1.11.1_1,3
Upstream
up to date
Last update
to 1.11.1_1,3 · 3f329d0bde
Quarterly
2026Q4: 1.11.1_1,3
WWW
https://www.libssh2.org/
Links
cgit · VuXML

Install

Package
# pkg install libssh2
installs 1.11.1_1,3 from latest; from quarterly (2026Q4) 1.11.1_1,3
Port
# cd /usr/ports/security/libssh2 && make install clean
# make -C /usr/ports/security/libssh2 config  # change options first
Size
250 KiB download · 476 KiB installed
Depends on
nothing
License
BSD3CLAUSE
Options
1 of 4 on in the package: OPENSSL
Show the 3 options that are off
GCRYPT STATIC TRACE

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 161.11.1_1,31.11.1_1,3–
FreeBSD 151.11.1_1,31.11.1_1,3–
FreeBSD 141.11.1_1,31.11.1_1,31.11.1_1,3

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 151.11.1_1,31.11.1_1,3–
FreeBSD 141.11.1_1,31.11.1_1,31.11.1_1,3

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed (10)

The CVE record lists the packaged version 1.11.1_1,3 as affected, and no VuXML entry names the CVE. What does this mean?

CVECVSSPublishedDescription
CVE-2026-552009.22026-06-17libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field…
CVE-2026-660328.72026-07-24libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to cor…
CVE-2026-660338.72026-07-24libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2_cipher_crypt() function in src/openssl.c that …
CVE-2026-580508.32026-06-28libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation num_attrs * sizeof(libssh2_p…
CVE-2026-580518.32026-06-28libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the…
CVE-2025-156618.32026-06-18libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c that allows a malicious S…
CVE-2026-551998.22026-06-17libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allow…
CVE-2026-660347.72026-07-24libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out…
CVE-2026-660357.72026-07-24libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap meta…
CVE-2026-75986.92026-05-01A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation …

VuXML only (0)

Listed in VuXML, the packaged version 1.11.1_1,3 is still in the affected range; pkg audit reports it. What does this mean?

None.

Fixed (2)

Show 2 fixed
VuXML entries whose affected range the packaged version has left.

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (91)

Sofian Brabez (sbz) · 1.4.2,2
- Update to 1.4.2
ac5616dc78
Sofian Brabez (sbz) · 1.4.1,2
- Update to 1.4.1

Approved by:	jadawin@, miwi@ (mentors, implicit)
ba99ff9e32
Sofian Brabez (sbz) · 1.4.0_1,2
- Fix build when using GCRYPT KNOB - Bump PORTREVISION

PR:		ports/164835
Submitted by:	Hirohisa Yamaguchi <umq at ueo.co.jp>
Approved by:	jadawin@, miwi@ (mentors, implicit)
908d44f398
Sofian Brabez (sbz) · 1.4.0,2
- Update to 1.4.0

Approved by:	jadawin@, miwi@ (mentors, implicit)
0ba4ae9ea0
Martin Wilke (miwi) · 1.3.0,2
- Remove WITH_FBSD10_FIX, is no longer needed
e1c6649edf
Martin Wilke (miwi) · 1.3.0,2
- Fix build on FreeBSD 10

Reported by:	pointyhat
69a39f5f38
Sofian Brabez (sbz) · 1.3.0,2
- Update to 1.3.0

Approved by:	jadawin@ (mentor)
f045d303f8
Sofian Brabez (sbz) · 1.2.9,2
- Update to 1.2.9 - Update pkg-descr - Make happy portlint

Approved by:	miwi@ (mentor)
ffbbeb4e91
Steve Wills (swills) · 1.2.8_2,2
- Chase the libgcrypt shared lib version
e0755b977d
Sofian Brabez (sbz) · 1.2.8_1,2
- Fix version of pkg-config - Bump PORTREVISION

PR:		ports/158195
Submitted by:	mandree@
Approved by:	miwi@ (mentor)
a8e7678ba0
Sofian Brabez (sbz) · 1.2.8,2
- Update to 1.2.8 - Add LICENSE

Approved by:	jadawin@ (mentor)
29417500d3
Sofian Brabez (sbz) · 1.2.7,2
Update my MAINTAINER address to sbz at FreeBSD.org.

Approved by:	jadawin@ (mentor)
d7c5457ddf
Philippe Audeoud (jadawin) · 1.2.7,2
- Update to 1.2.7

PR:		ports/149799
Submitted by:	Sofian Brabez <sbrabez _AT_ gmail.com>
8f63b3f7d4
Wesley Shields (wxs) · 1.2.6_1,2
Chase security/libgcrypt shlib bump.

PR:		ports/148755
Submitted by:	Hirohisa Yamaguchi <umq@ueo.co.jp>
15c1551ea3
Pietro Cerutti (gahr) · 1.2.6,2
- Update to 1.2.6

PR:		147846
Submitted by:	Sofian Brabez <sbrabez@gmail.com> (maintainer)
98eadcd5db
David Thiel (lx) · 1.2.5,2
Update to 1.2.5 and hand maintainership to Sofian Brabez.

PR:		ports/145760
Submitted by:	sbrabez@gmail.com
31ae7c69e0
David Thiel (lx) · 1.2.4,2
Update to 1.2.4.

PR:		ports/144202
Submitted by:	Sofian Brabez <sbrabez@gmail.com>
Feature safe:	yes
1dfd3e6b7b
David Thiel (lx) · 1.2.3,2
Update to 1.2.3.

PR:		ports/143542
Submitted by:	Sofian Brabez
3a80948661
Pav Lucistnik (pav) · 1.2.2,2
- Add TRACE and ZLIB options

PR:		ports/140711
Submitted by:	Sofian Brabez <sbrabez@gmail.com>
Approved by:	maintainer timeout (lx; 18 days)
d86dba7bdc
David Thiel (lx) · 1.2.2,2
Update to 1.2.2.

PR:		ports/140626
Submitted by: David Naylor
Feature safe:	yes
713f338423
David Thiel (lx) · 1.2.1,2
Remove @dirrmtry for libdata/pkgconfig directory. This directory is in BSD.local.dist.

Submitted by:	QAT
Feature safe:	yes
3febcac536
David Thiel (lx) · 1.2.1,2
Support libgcrypt, and update to 1.2.1, a bugfix release.

PR:		ports/138473
Submitted by:	Peter Wullinger
Feature safe:	yes
c8f53ebab5
David Thiel (lx) · 1.2,2
Update to 1.2.

PR:	137760
Submitted by:	Sofian Brabez
Approved by:	maintainer
3d31f1b2a9
David Thiel (lx) · 1.1,2
Update to 1.1.

PR:		ports/133336
Submitted by:	Sofian Brabez <sbrabez@gmail.com>
Approved by:	lx (maintainer)
77a0c6a037
David Thiel (lx) · 1.0,2
Argh. So, the update notifier was wrong, and 0.2 is not a new release (of course), but I was fooled because there's a separate project called libssh which *did* just have a new release. 1.0 is the real update.

Pointed out by: J. Johnston
1319a93963
David Thiel (lx) · 0.2,1
Include appropriate openssl headers.
e28e692846
David Thiel (lx) · 0.2,1
Update to 0.2.
14d05cde40
Rong-En Fan (rafan) · 0.18
Update CONFIGURE_ARGS for how we pass CONFIGURE_TARGET to configure script. Specifically, newer autoconf (> 2.13) has different semantic of the configure target. In short, one should use --build=CONFIGURE_TARGET instead of CONFIGURE_TARGET directly. Otherwise, you will get a warning and the old semantic may be removed in later autoconf releases.

To workaround this issue, many ports hack the CONFIGURE_TARGET variable
so that it contains the ``--build='' prefix.

To solve this issue, under the fact that some ports still have
configure script generated by the old autoconf, we use runtime detection
in the do-configure target so that the proper argument can be used.

Changes to Mk/*:
 - Add runtime detection magic in bsd.port.mk
 - Remove CONFIGURE_TARGET hack in various bsd.*.mk
 - USE_GNOME=gnometarget is now an no-op

Changes to individual ports, other than removing the CONFIGURE_TARGET hack:

= pkg-plist changed (due to the ugly CONFIGURE_TARGET prefix in * executables)
  - comms/gnuradio
  - science/abinit
  - science/elmer-fem
  - science/elmer-matc
  - science/elmer-meshgen2d
  - science/elmerfront
  - science/elmerpost

= use x86_64 as ARCH
  - devel/g-wrap

= other changes
  - print/magicfilter
    GNU_CONFIGURE -> HAS_CONFIGURE since it's not generated by autoconf

Total # of ports modified:  1,027
Total # of ports affected: ~7,000 (set GNU_CONFIGURE to yes)

PR:		126524 (obsoletes 52917)
Submitted by:	rafan
Tested on:	two pointyhat 7-amd64 exp runs (by pav)
Approved by:	portmgr (pav)
741aa71483
David Thiel (lx) · 0.18
Update to 0.18.
0f45e3e389
David Thiel (lx) · 0.17
Update to 0.17.
a8df590e93
Rong-En Fan (rafan) · 0.15
- Set --mandir and --infodir in CONFIGURE_ARGS if the configure script   supports them.  This is determined by running ``configure --help'' in   do-configure target and set the shell variable _LATE_CONFIGURE_ARGS   which is then passed to CONFIGURE_ARGS. - Remove --mandir and --infodir in ports' Makefile where applicable   Few ports use REINPLACE_CMD to achieve the same effect, remove them too. - 

PR:		ports/111470
Approved by:	portmgr
Discussed with:	stas (Mk/*), gerald (info related stuffs)
Tested by:	pointyhat exp run
f935a609c5
David Thiel (lx) · 0.15
Updating to 0.15.
4be47df624
Emanuel Haupt (ehaupt) · 0.14_1
- Provide a patch to fix a bug in the configure script that caused the include   and library directory flags to gcc to be wrong - Bump PORTREVISION

PR:		102920
Submitted by:	David Thiel <lx@redundancy.redundancy.org> (maintainer)
3b3202afc1
Cheng-Lung Sung (clsung) · 0.14
- Updating libssh2 to 0.14. Changes:   - Plug leaks in EVP cipher init/shutdown. (Selcuk Gueney)   - Allow socket_fd == 0 in libssh2_session_startup(). (puudeli)   - Swap ordering of packet_add/packet-inspection to avoid inspect after   - free. (Selcuk)   - Swap KEX_INIT ordering, send our KEX_INIT first.   - Add check for oportunistic KEX_INIT packets.  Burn bad guess if necessary.   - Fix OpenSS

PR:		ports/100127
Submitted by:	maintainer (David Thiel)
4ff3f1b6ad
Pav Lucistnik (pav) · 0.13
- Adopt

PR:		ports/97860
Submitted by:	David Thiel <lx@redundancy.redundancy.org>
3b0689b2ca
Cheng-Lung Sung (clsung) · 0.13
- update to 0.13
31e6338ce2
Marcus Alves Grando (mnag) · 0.12
Update to 0.12 Add SHA256

PR:		89239
Submitted by:	KATO Tsuguru <tkato432@yahoo.com>
c493ac0ce4
Florent Thoumie (flz) · 0.11
- Update to 0.11.

PR:		ports/83401
Submitted by:	Marcus Grando <marcus@corp.grupos.com.br>
a7633f04ef
Michael Johnson (ahze) · 0.10
- Update to 0.10

PR:		ports/82280
Submitted by:	Ports Fury
1295f99ab3
Alexander Leidinger (netchild) · 0.8_1
Fix post-install target.

Noticed by:	pointyhat (via kris)
14663c511b
Alexander Leidinger (netchild) · 0.8
libssh2 is a library implementing the SSH2 protocol as defined by Internet Drafts: SECSH-TRANS(22), SECSH-USERAUTH(25), SECSH-CONNECTION(23), SECSH-ARCH(20), SECSH-FILEXFER(06)*, SECSH-DHGEX(04), and SECSH-NUMBERS(10).
d2ae1f9d87