Skip to main content

libssh2 CVE-2026-55199

HIGH
Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)
2026-06-17 VulnCheck
Denial Of Service Microsoft Libssh2
8.2
CVSS 4.0 · Vendor: VulnCheck
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Stand up malicious SSH server
  2. Delivery
    Lure libssh2 client to connect
  3. Exploit
    Send SSH_MSG_EXT_INFO with nr_extensions=0xFFFFFFFF
  4. Execution
    Client enters unbounded parse loop
  5. Persist
    CPU pinned >60s per connection
  6. Impact
    Repeat across victims for fleet DoS

Vulnerability Assessment

Weakness
CWE
CWE-835
ASVS 5.0
V15 - Secure Coding and Architecture Loop termination conditions
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

The victim must initiate an outbound SSH connection from a libssh2-linked client (version <= 1.11.1) to a server the attacker controls or has compromised - this is a server-to-client attack, not a server-side exposure, so internet-facing SSH servers are not the target surface. No authentication, user interaction beyond initiating the connection, or non-default configuration is required on the client side; the malicious behavior is triggered during key exchange (SSH_MSG_EXT_INFO), which occurs before authentication. The limiting factor is delivery: the attacker needs the victim to connect to a hostile endpoint, achieved via typosquatting, DNS/BGP hijack, MITM on unauthenticated host-key-first-use, or compromise of a legitimate SSH service.
Impact

The CVSS 4.0 vector AV:N/AC:L/AT:P/PR:N/UI:N with VA:H captures the real risk profile accurately: network-reachable, low complexity, no privileges or interaction, with availability-only impact and an attack requirement (AT:P) reflecting the need for the victim to actually connect to the attacker-controlled server. There is no EPSS score, KEV listing, or public PoC code identified at time of analysis, so this is not a mass-exploitation candidate, but the bug is trivially reproducible from the public PR diff and the affected library is embedded in an enormous number of downstream products, which raises supply-chain urgency above what the raw 8.2 score might suggest. Note the directionality: this is a server-to-client attack, so the realistic threat model is users or automated agents (CI systems, git clients, backup tools) connecting to hostile or compromised SSH endpoints, not exposed servers being scanned - defenders should weight risk by outbound SSH client usage, not inbound exposure.
Exploit ScenarioDerived

An attacker stands up a malicious SSH server - for example, by typosquatting a popular git hosting domain, poisoning DNS, or compromising a legitimate Git/SCP endpoint - and waits for libssh2-based clients (CI runners, backup agents, developer git pulls) to connect. During the SSH_MSG_EXT_INFO portion of key exchange, the server sends nr_extensions = 0xFFFFFFFF, and each connecting client pins one CPU core at 100% for at least 60 seconds, enabling fleet-wide degradation of CI pipelines or developer workflows; no public exploit identified at time of analysis but the one-line trigger is directly visible in the patch diff.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 17, 2026

Pre-authentication denial of service in libssh2 through 1.11.1 allows a malicious SSH server to pin a connecting client's CPU at 100% for over 60 seconds by advertising an attacker-controlled SSH_MSG_EXT_INFO extension count of 0xFFFFFFFF during key exchange. The flaw is reachable before authentication completes, so any client that initiates an SSH session to a hostile or compromised server endpoint is exposed, and no public exploit identified at time of analysis though VulnCheck has published an advisory and the upstream PR diff is public.

RemediationAI

Upstream fix available (PR/commit 17626857d20b3c9a1addfa45979dadcee1cd84a4 merged via PR #1864); a released patched libssh2 version is not independently confirmed in the provided data, so rebuild from the fixed commit or wait for a tagged release after 1.11.1 and then upgrade all downstream consumers. The code change adds return-value checks to the two _libssh2_get_string() calls in the SSH_MSG_EXT_INFO loop so a malformed packet breaks out instead of spinning. As a compensating control where rebuilding is not immediately possible, restrict outbound SSH client connections from sensitive hosts to a known-good allowlist of server endpoints (this blocks the malicious-server delivery vector but breaks legitimate ad-hoc SSH and may disrupt git-over-ssh workflows), and consider running long-lived SSH client processes under a CPU cgroup or ulimit -t bound so a hung extension loop is killed rather than blocking other work (side effect: legitimate slow key exchanges on weak CPUs may also be terminated).

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

libssh2 is a widely embedded C client library implementing the SSH2 protocol, used by curl, git, PHP, Python bindings, and numerous Microsoft and Linux components (reflected in the Microsoft tag). The vulnerability is a CWE-835 (Loop with Unreachable Exit Condition / infinite loop) in the SSH_MSG_EXT_INFO handler in src/packet.c near line 890, where the code calls _libssh2_get_string() twice per extension inside a loop bounded by an attacker-supplied nr_extensions field but never checks the parser's return value. When the server sets nr_extensions to 0xFFFFFFFF, the loop body fails to consume new bytes yet keeps iterating roughly four billion times, and because the libssh2 session timeout only governs network I/O it cannot interrupt a CPU-bound loop. The CPE cpe:2.3:a:libssh2:libssh2:*:*:*:*:*:*:*:* covers all versions up to and including 1.11.1.

Know when Libssh2 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulnCheck) PRIMARY 8.2 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
vuln.today AI 6.5 MEDIUM

Server-to-client attack requires the victim to initiate an outbound SSH connection (UI:R), no auth before the bug triggers (PR:N), and impact is CPU-bound DoS only (A:H, C/I:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.9 MEDIUM

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
Present
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
None
Vulnerable system: Availability
High
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

DescriptionCVE.org

libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can set nr_extensions to 0xFFFFFFFF during key exchange, causing the client to spin in a tight CPU loop for over 60 seconds because return values from _libssh2_get_string() are unchecked and the session timeout does not apply to CPU-bound loops.

Executive ViewAI

Why It Matters

libssh2 through version 1.11.1 contains a pre-authentication denial-of-service vulnerability (CVE-2026-55199, CVSS 8.2) allowing malicious SSH servers to exhaust client CPU for over 60 seconds, disrupting SSH-dependent operations. Any application or system using libssh2 is exposed when connecting to compromised infrastructure, impacting automated workflows, deployment pipelines, and remote management. The vulnerability is reachable before authentication, representing a significant availability threat.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.4%
Top 71% exploitable
Exploit
POC
Public exploit code exists
Social Media
1
Sightings
Data Quality
7 sources
Confidence: High
NVD CVE.org EPSS Vulnrichment MSRC Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.4%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Partial

Priority Score

61
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +41
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)CVE.org

cpe:2.3:a:libssh2:libssh2:*:*:*:*:*:*:*:*

More in Libssh2

View all
CVE-2023-48795 MEDIUM POC
5.9 Dec 18

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
CVE-2026-55200 CRITICAL POC
9.2 Jun 17

Remote code execution in libssh2 through version 1.11.1 stems from an unchecked packet_length field in ssh2_transport_re
CVE-2019-17498 HIGH POC
8.1 Oct 21

In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds che
CVE-2026-58050 HIGH POC
8.3 Jun 28

Heap buffer overflow in the libssh2 SSH client library (all versions through 1.11.1) lets a malicious or compromised SSH
CVE-2026-58051 HIGH POC
8.3 Jun 28

Free of an uninitialized, attacker-influenceable pointer in libssh2 through 1.11.1 allows a malicious SSH server to corr
CVE-2025-15661 HIGH POC
8.3 Jun 18

Out-of-bounds heap read in libssh2 through 1.11.1 enables a malicious SFTP server or man-in-the-middle attacker to leak

CVE-2019-13115 HIGH POC
8.1 Jul 16

In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow t
CVE-2019-3862 CRITICAL
9.1 Mar 21

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exi
CVE-2019-3855 HIGH
8.8 Mar 21

An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way pa
CVE-2019-3858 CRITICAL
9.1 Mar 21

An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from

CVE-2019-3859 CRITICAL
9.1 Mar 21

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_req
CVE-2019-3861 CRITICAL
9.1 Mar 25

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value gre

Same weakness CWE-835 – Loop with Unreachable Exit Condition (Infinite Loop)

View all
CVE-2024-20353 HIGH POC
8.6
CVE-2020-13935 HIGH POC
7.5
CVE-2017-16944 HIGH POC
7.5
CVE-2022-0778 HIGH POC
7.5
CVE-2024-43366 CRITICAL POC
9.1
CVE-2026-25533 HIGH POC
8.8
CVE-2018-8002 HIGH POC
8.8
CVE-2026-66730 HIGH POC
8.7

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected

References

Advisories & patches
PATCH https://github.com/libssh2/libssh2/commit/17626857d20b3c9a1addfa45979dadcee1cd84a4 ADVISORY https://access.redhat.com/errata/RHSA-2026:29950 ADVISORY https://seclists.org/oss-sec/2026/q2/1010 ADVISORY https://seclists.org/oss-sec/2026/q2/1014 ADVISORY https://seclists.org/oss-sec/2026/q2/1017 ADVISORY https://ubuntu.com/security/notices/USN-8486-1 ADVISORY https://vuldb.com/vuln/372110 REF https://github.com/libssh2/libssh2/pull/1864 REF https://www.vulncheck.com/advisories/libssh2-pre-authentication-dos-via-ssh-msg-ext-info-handler

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy