Backport the fix for CVE-2026-660= 34.

The publickey subsystem does not sufficiently validate the length of a
server-controlled comment field. A malformed response can therefore
cause an out-of-bounds read.

Use Debian's libssh2 1.11.1 backport of the upstream fix.

Signed-off-by: Stefan M=C3=BCller <stefan.mueller@rey-technology.com>=
---
Backport to: 2025.02.x
---
...009-publickey-fix-potential-OOB-read.patch | 35 +++= 3;++++++++++++++= 3;
package/libssh2/libssh2.mk       &= nbsp;            |&n= bsp; 3 ++
2 files changed, 38 insertions(+)
create mode 100644 package/libssh2/0009-publickey-fix-potential-OOB-r= ead.patch

diff --git a/package/libssh2/0009-publickey-fix-potential-OOB-read.patch b/= package/libssh2/0009-publickey-fix-potential-OOB-read.patch
new file mode 100644
index 0000000000..96b633f3d1
--- /dev/null
+++ b/package/libssh2/0009-publickey-fix-potential-OOB-read.pat= ch
@@ -0,0 +1,35 @@
+From a13bb6c773f0d55ad1628cede57e99803cd898d9 Mon Sep 17 00:00:00 2001=
+From: Viktor Szakats <commit@vsz.me>
+Date: Sat, 4 Jul 2026 11:19:49 +0200
+Subject: [PATCH] publickey: fix potential OOB read in
+ `libssh2_publickey_list_fetch()`
+
+Reported-by: Vladimir Eli Tokarev
+Fixes GHSA-w6g9-cpfp-22gc
+
+Closes #2202
+Forwarded: not-needed
+
+CVE: CVE-2026-66034
+Upstream: https://github.com/libssh2/libssh2/commi= t/a13bb6c773f0d55ad1628cede57e99803cd898d9
+Signed-off-by: Stefan M=C3=BCller <stefan.mueller@rey-technology.co= m>
+---
+ src/publickey.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/src/publickey.c
++++ b/src/publickey.c
+@@ -988,6 +988,13 @@
+           &nbs= p;     }
+
+           &nbs= p;     if(comment_len) {
++           = ;         if(pkey->listFetch_s &= #43; comment_len >
++           = ;            pkey-&g= t;listFetch_data + pkey->listFetch_data_len) {
++           = ;             _= libssh2_error(session, LIBSSH2_ERROR_BUFFER_TOO_SMALL,
++           = ;            &n= bsp;         "ListFetch data t= oo short");
++           = ;             g= oto err_exit;
++           = ;         }
++
+           &nbs= p;         list[keys].num_attrs =3D= 1;
+           &nbs= p;         list[keys].attrs =3D
+           &nbs= p;             = LIBSSH2_ALLOC(session,
diff --git a/package/libssh2/libssh2.mk b/package/libssh2/libssh2.mk
index a3c0b6a67f..4a4491f0f1 100644
--- a/package/libssh2/libssh2.mk
+++ b/package/libssh2/libssh2.mk
@@ -33,6 +33,9 @@ LIBSSH2_IGNORE_CVES +=3D CVE-2026-66032
# 0008-openssl-fix-AES-GCM-bounds-checks.patch
LIBSSH2_IGNORE_CVES +=3D CVE-2026-66033

+# 0009-publickey-fix-potential-OOB-read.patch
+LIBSSH2_IGNORE_CVES +=3D CVE-2026-66034
+
ifeq ($(BR2_PACKAGE_LIBSSH2_MBEDTLS),y)
LIBSSH2_DEPENDENCIES +=3D mbedtls
LIBSSH2_CONF_OPTS +=3D --with-libmbedcrypto-prefix=3D$(STAGING_DI= R)/usr \
--
2.25.1