CVE-2026-66032 (HIGH): detected in Lambda Docker Images.

## CVE Details

| **CVE ID** | **Severity** | **Affected Package** | **Installed Version** | **Fixed Version** | **Date Published** | **Date of Scan** |
|-----------------|--------------|----------------------|-----------------------|-------------------|--------------------|------------------|
| [CVE-2026-66032](https://avd.aquasec.com/nvd/cve-2026-66032) | `HIGH` | `libssh2` | `1.4.3-12.amzn2.2.8` | `1.4.3-12.amzn2.2.9` | `2026-07-24T17:17:35.12Z` | `2026-08-18T10:18:32.607164957Z` |

---

## Affected Docker Images

| **Image Name** | **SHA** |
|-----------------------------|---------------------------------------|
| `public.ecr.aws/lambda/python:3.11` | `public.ecr.aws/lambda/python@sha256:0673f5ca484c1a0a9cb48282cbb2339f5965e8d029040f8d39c0892b4567b35a` |
| `public.ecr.aws/lambda/python:3.10` | `public.ecr.aws/lambda/python@sha256:cf4159f07c2d96c197cbf5be56d9381fcc88dc99f64bf06117f977a2aee36e0e` |
| `public.ecr.aws/lambda/java:17` | `public.ecr.aws/lambda/java@sha256:2b14f1d7afb02ac2a817250ee594b3aad5e445aeac4b1bbcdd7125d5b28f348f` |
| `public.ecr.aws/lambda/java:11` | `public.ecr.aws/lambda/java@sha256:60832bef6402b70f842b69f260e0e6419e743966f33cb3901acc5b9c717515da` |
| `public.ecr.aws/lambda/java:8.al2` | `public.ecr.aws/lambda/java@sha256:621169a1e12c184e6c7a8c99dfe33f62c2df8bde0c9368b9a115d7ffab5d3967` |

---

## Description

> libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSH_FXP_OPEN with SSH_FXP_STATUS containing FX_OK, the response data buffer is freed, and if a subsequent sftp_packet_require() call returns a specific error such as LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED, the same pointer is freed a second time, enabling tcache dup conditions on glibc systems that allow overlapping allocations and function pointer overwrites.

---

### Remediation Steps
- Update the affected package `libssh2` from version `1.4.3-12.amzn2.2.8` to `1.4.3-12.amzn2.2.9`.

### About this issue
- This issue may not contain all the information about the CVE nor the images it affects.
- This issue will not be updated with new information and the list of affected images may have changed since the creation of this issue.
- For more, visit [Lambda Watchdog](https://lambdawatchdog.com).
- This issue was created automatically by Lambda Watchdog.

Start with the five affected Lambda image references and the reported libssh2 version 1.4.3-12.amzn2.2.8. Identify how these base images are built or refreshed, then verify that rebuilt images contain 1.4.3-12.amzn2.2.9 and no longer report CVE-2026-66032.

Written by the indexing model from the issue text.