CVE-2026-66034 (HIGH): detected in Lambda Docker Images.

## CVE Details

| **CVE ID** | **Severity** | **Affected Package** | **Installed Version** | **Fixed Version** | **Date Published** | **Date of Scan** |
|-----------------|--------------|----------------------|-----------------------|-------------------|--------------------|------------------|
| [CVE-2026-66034](https://avd.aquasec.com/nvd/cve-2026-66034) | `HIGH` | `libssh2` | `1.4.3-12.amzn2.2.8` | `1.4.3-12.amzn2.2.9` | `2026-07-24T17:17:35.407Z` | `2026-08-18T10:18:32.607164957Z` |

---

## Affected Docker Images

| **Image Name** | **SHA** |
|-----------------------------|---------------------------------------|
| `public.ecr.aws/lambda/python:3.11` | `public.ecr.aws/lambda/python@sha256:0673f5ca484c1a0a9cb48282cbb2339f5965e8d029040f8d39c0892b4567b35a` |
| `public.ecr.aws/lambda/python:3.10` | `public.ecr.aws/lambda/python@sha256:cf4159f07c2d96c197cbf5be56d9381fcc88dc99f64bf06117f977a2aee36e0e` |
| `public.ecr.aws/lambda/java:17` | `public.ecr.aws/lambda/java@sha256:2b14f1d7afb02ac2a817250ee594b3aad5e445aeac4b1bbcdd7125d5b28f348f` |
| `public.ecr.aws/lambda/java:11` | `public.ecr.aws/lambda/java@sha256:60832bef6402b70f842b69f260e0e6419e743966f33cb3901acc5b9c717515da` |
| `public.ecr.aws/lambda/java:8.al2` | `public.ecr.aws/lambda/java@sha256:621169a1e12c184e6c7a8c99dfe33f62c2df8bde0c9368b9a115d7ffab5d3967` |

---

## Description

> libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of an uninitialized pointer via the publickey subsystem. In libssh2_publickey_list_fetch(), the version 1 response parser reads a server-controlled comment_len value and advances the parse pointer without verifying sufficient bytes remain in the buffer, causing the out-of-bounds read to leak heap pointers from adjacent allocations defeating ASLR, followed by heap allocator state corruption when the error cleanup path frees an uninitialized pointer from a non-zeroed realloc() region.

---

### Remediation Steps
- Update the affected package `libssh2` from version `1.4.3-12.amzn2.2.8` to `1.4.3-12.amzn2.2.9`.

### About this issue
- This issue may not contain all the information about the CVE nor the images it affects.
- This issue will not be updated with new information and the list of affected images may have changed since the creation of this issue.
- For more, visit [Lambda Watchdog](https://lambdawatchdog.com).
- This issue was created automatically by Lambda Watchdog.

Start by locating the Docker image definitions for the affected AWS Lambda Python and Java base images, then review how their Amazon Linux packages are selected. Check the CVE-2026-66034 details and verify that the resulting images contain libssh2 version 1.4.3-12.amzn2.2.9 or later.

Written by the indexing model from the issue text.