libssh2 versions through 1.11.1 contain a double-free vulnerability in the sftp_open() function. This flaw allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session by freeing the same memory pointer twice under specific conditions. The issue was fixed in commit 5e47761.