Ubuntu patches libssh2 across five LTS releases including ESM lines
Victoria Shinder1 min readCanonical published USN-8799-1 on 22 September 2026, fixing several security issues in libssh2. The notice lists five affected releases: Ubuntu 22.04 LTS, 20.04 LTS, 18.04 LTS, 16.04 LTS and 14.04 LTS.
libssh2 is a client-side SSH library. It is rarely installed deliberately and is almost always present, pulled in as a dependency by tools that speak SSH or SFTP without shelling out — notably curl builds with SCP and SFTP support, and a long tail of language bindings that wrap it.
The span of the release list is the part to read carefully. 16.04 and 14.04 are long past standard support, which places these updates in Expanded Security Maintenance. A machine on one of those releases without an ESM subscription attached does not receive this fix, and nothing on the host will say so.
What it means
The practical work is not the upgrade command, it is the inventory. Because libssh2 arrives as a dependency, the set of hosts that have it is usually larger than the set anybody tracks, and it tends to be linked into utilities that run in build pipelines and backup jobs rather than on interactive servers. Those are the machines that get patched last, and they are also the ones holding credentials.
For the two oldest releases, treat the notice as a prompt to confirm what the subscription state actually is, rather than assuming that appearing in a published advisory means the fix will arrive. We have not enumerated the individual CVEs here; the notice's own Details section is the place to take them from before writing any change record.