Skip to main content

libssh2 CVE-2026-55200

CRITICAL
Integer Overflow to Buffer Overflow (CWE-680)
2026-06-17 VulnCheck
Buffer Overflow RCE Libssh2
9.2
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
9.2 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.1 HIGH

Network-reachable and unauthenticated, but exploitation requires the libssh2 client to connect to a malicious SSH server and reliable heap RCE against modern hardening raises AC to High.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat
8.1 HIGH
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Source Code Evidence Fetched
Jun 17, 2026 - 20:01 vuln.today
Analysis Generated
Jun 17, 2026 - 20:01 vuln.today

DescriptionCVE.org

libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.

AnalysisAI

Remote code execution in libssh2 through version 1.11.1 stems from an unchecked packet_length field in ssh2_transport_read() that allows attackers to send oversized SSH packets and corrupt heap memory. The flaw was reported by VulnCheck and is fixed upstream in commit 97acf3df (PR #2052), which adds an upper-bound check against LIBSSH2_PACKET_MAXPAYLOAD. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 9.2 reflects pre-authentication network reach with high impact on confidentiality, integrity, and availability.

Technical ContextAI

libssh2 is a widely embedded client-side C library implementing the SSH-2 protocol, used by curl, git, and numerous management agents and appliances to establish outbound SSH/SCP/SFTP sessions. The defect is classified as CWE-680 (Integer Overflow to Buffer Overflow): the SSH binary packet protocol prefixes each packet with a 32-bit length field, and ssh2_transport_read() in src/transport.c read this field and previously only rejected values below 1, accepting any large value up to UINT32_MAX. Downstream allocation and copy logic then operated on the attacker-controlled length, producing an out-of-bounds write on the heap. The upstream fix adds an else-if branch returning LIBSSH2_ERROR_OUT_OF_BOUNDARY when p->packet_length exceeds LIBSSH2_PACKET_MAXPAYLOAD, enforcing the protocol's intended ceiling. Because libssh2 is normally invoked as a client, the malicious peer is typically a server the victim connects to.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply commit 97acf3dfda80c91c3a8c9f2372546301d4a1a7a8 from https://github.com/libssh2/libssh2/pull/2052 or upgrade to the first tagged libssh2 release that includes it (post-1.11.1) once distributors publish it, and rebuild downstream consumers (curl, language bindings, container base images) against the patched library. Audit your environment for statically linked copies, since OS-level package upgrades will not cover bundled libssh2 inside third-party binaries or appliances. Until patched libraries are deployed, the practical compensating control is to restrict outbound SSH/SCP/SFTP from libssh2-using clients to a known-good allowlist of SSH servers, since exploitation requires the client to receive crafted server-side traffic; egress filtering on TCP/22 to untrusted destinations meaningfully reduces exposure but will break legitimate SSH to arbitrary hosts. Consult the VulnCheck advisory at https://www.vulncheck.com/advisories/libssh2-out-of-bounds-write-via-unchecked-packet-length-in-transport-c for additional vendor guidance.

More in Libssh2

View all
CVE-2023-48795 MEDIUM POC
5.9 Dec 18

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
CVE-2026-58050 HIGH POC
8.3 Jun 28

Heap buffer overflow in the libssh2 SSH client library (all versions through 1.11.1) lets a malicious or compromised SSH
CVE-2026-58051 HIGH POC
8.3 Jun 28

Free of an uninitialized, attacker-influenceable pointer in libssh2 through 1.11.1 allows a malicious SSH server to corr
CVE-2019-17498 HIGH POC
8.1 Oct 21

In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds che
CVE-2019-13115 HIGH POC
8.1 Jul 16

In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow t
CVE-2019-3861 CRITICAL
9.1 Mar 25

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value gre
CVE-2019-3860 CRITICAL
9.1 Mar 25

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed
CVE-2019-3858 CRITICAL
9.1 Mar 21

An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from

CVE-2019-3862 CRITICAL
9.1 Mar 21

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exi
CVE-2019-3859 CRITICAL
9.1 Mar 21

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_req
CVE-2019-3857 HIGH
8.8 Mar 25

An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SS
CVE-2019-3856 HIGH
8.8 Mar 25

An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way

Same weakness CWE-680 – Integer Overflow to Buffer Overflow

View all
CVE-2021-40417 CRITICAL POC
9.8
CVE-2021-21832 CRITICAL POC
9.8
CVE-2021-21783 CRITICAL POC
9.8
CVE-2018-8787 CRITICAL POC
9.8
CVE-2018-8786 CRITICAL POC
9.8
CVE-2025-32023 HIGH POC
7.0
CVE-2021-3321 HIGH POC
8.8
CVE-2021-21850 HIGH POC
8.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2017-11882 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Server 16.0 Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Micro 5.3 Not-Affected

Share

CVE-2026-55200 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy