Product
libssh2 library

Version
all

Date
2021-12-17

Vulnerability
libssh2 does not check userauth_kybd_auth_name_len which comes from a remote server and uses it as memcpy's argument. A remote attacker who compromises a SSH server may be able to crash the client when a user connects to the server.

PoC
https://gitee.com/zzixuan/libssh2-buffer-overflow-poc/tree/master/

Solution
Validate userauth_kybd_auth_name_len in advance.