CVE-2026-66034 (HIGH): detected in Lambda Docker Images.

[the-lambda-watchdog]

CVE Details

CVE ID	Severity	Affected Package	Installed Version	Fixed Version	Date Published	Date of Scan
CVE-2026-66034	HIGH	libssh2	1.4.3-12.amzn2.2.8	1.4.3-12.amzn2.2.9	2026-07-24T17:17:35.407Z	2026-08-18T10:18:32.607164957Z

---

Affected Docker Images

Image Name	SHA
public.ecr.aws/lambda/python:3.11	public.ecr.aws/lambda/python@sha256:0673f5ca484c1a0a9cb48282cbb2339f5965e8d029040f8d39c0892b4567b35a
public.ecr.aws/lambda/python:3.10	public.ecr.aws/lambda/python@sha256:cf4159f07c2d96c197cbf5be56d9381fcc88dc99f64bf06117f977a2aee36e0e
public.ecr.aws/lambda/java:17	public.ecr.aws/lambda/java@sha256:2b14f1d7afb02ac2a817250ee594b3aad5e445aeac4b1bbcdd7125d5b28f348f
public.ecr.aws/lambda/java:11	public.ecr.aws/lambda/java@sha256:60832bef6402b70f842b69f260e0e6419e743966f33cb3901acc5b9c717515da
public.ecr.aws/lambda/java:8.al2	public.ecr.aws/lambda/java@sha256:621169a1e12c184e6c7a8c99dfe33f62c2df8bde0c9368b9a115d7ffab5d3967

---

Description

libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of an uninitialized pointer via the publickey subsystem. In libssh2_publickey_list_fetch(), the version 1 response parser reads a server-controlled comment_len value and advances the parse pointer without verifying sufficient bytes remain in the buffer, causing the out-of-bounds read to leak heap pointers from adjacent allocations defeating ASLR, followed by heap allocator state corruption when the error cleanup path frees an uninitialized pointer from a non-zeroed realloc() region.

---

Remediation Steps

• Update the affected package libssh2 from version 1.4.3-12.amzn2.2.8 to 1.4.3-12.amzn2.2.9.

About this issue

• This issue may not contain all the information about the CVE nor the images it affects.
• This issue will not be updated with new information and the list of affected images may have changed since the creation of this issue.
• For more, visit Lambda Watchdog.
• This issue was created automatically by Lambda Watchdog.