{"id":"AZL-90936","summary":"CVE-2025-15661 affecting package libssh2 for versions less than 1.11.1-4","details":"libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c that allows a malicious SSH server or man-in-the-middle attacker to disclose heap memory contents or cause a crash by sending a crafted SSH_FXP_NAME response. Attackers can supply a link_len value larger than the actual packet data in SSH_FXP_NAME responses for SFTP READLINK and REALPATH operations, triggering a heap buffer over-read of up to target_len minus one bytes due to the missing validation of available packet buffer size before the memcpy operation.","modified":"2026-09-16T06:39:01Z","published":"2026-06-18T21:16:27Z","upstream":["CVE-2025-15661"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15661"}],"affected":[{"package":{"name":"libssh2","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/libssh2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-4"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-90936.json"}}],"schema_version":"1.9.0"}