A vulnerability in libssh2 versions prior to 1.11.1_3 allows a malicious SSH server to cause the client to operate on an uninitialized pointer during publickey list cleanup. This occurs because new entries in the publickey list are not zero-initialized before parsing, leading to potential use of attacker-controlled memory during cleanup if parsing fails.