Skip to main content

libssh2 CVE-2026-55200

CRITICAL
Integer Overflow to Buffer Overflow (CWE-680)
2026-06-17 VulnCheck
RCE Buffer Overflow Libssh2
9.2
CVSS 4.0 · Vendor: VulnCheck
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify libssh2-using client
  2. Delivery
    Lure client to attacker SSH server
  3. Exploit
    Send crafted packet with oversized packet_length
  4. Execution
    Trigger OOB heap write in ssh2_transport_read()
  5. Persist
    Hijack control flow in client process
  6. Impact
    Execute arbitrary code as client user

Vulnerability Assessment

Weakness
CWE
CWE-680
ASVS 5.0
V15 - Secure Coding and Architecture Integer-to-buffer conversion safety
Exploitation Conditions

The vulnerable code path is reached when a libssh2-based client establishes an SSH transport session with an attacker-controlled or compromised SSH server and processes a server-sent binary packet whose 32-bit packet_length header exceeds LIBSSH2_PACKET_MAXPAYLOAD; no victim authentication, credentials, or user interaction beyond initiating the SSH connection is required (PR:N, UI:N). Limiting factors: the affected process must be using libssh2 ≤ 1.11.1 without the PR #2052 patch, the victim must reach the malicious server over the network (libssh2 is overwhelmingly used in client mode, so server-to-client coercion or DNS/MITM redirection is typically needed), and the CVSS 4.0 AT:P attack-requirement flag reflects that the malicious peer is a precondition rather than any host on the network being exploitable. Successful RCE additionally depends on defeating heap allocator hardening and ASLR on the target platform.
Impact

The CVSS 4.0 vector AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N indicates a network-reachable, low-complexity, unauthenticated flaw with high impact across the CIA triad, but the AT:P (Attack Requirements: Present) hint is meaningful - exploitation requires the victim libssh2 client to connect to an attacker-controlled or compromised SSH server, which is not a default condition of being on the network. Heap-based out-of-bounds writes in C are realistically weaponizable, especially against unhardened embedded builds, but modern allocator hardening, ASLR, and the need to bypass libssh2's wire-format state machine raise practical complexity beyond what AC:L suggests. No EPSS score, KEV listing, or public PoC was provided, so this should be treated as a high-priority patching item for any product embedding libssh2 - particularly automation tools that connect to untrusted SSH endpoints - rather than as confirmed mass-exploitation risk. The reporter (VulnCheck) is a credible vulnerability research firm, which lends weight to the technical severity even absent observed exploitation.
Exploit ScenarioDerived

An attacker stands up a malicious SSH server (or compromises an existing one) and lures or coerces a victim system using a vulnerable libssh2 client - for example, a CI runner cloning over git+ssh or a backup agent performing SCP - into connecting to it. During the SSH transport handshake the server emits a crafted binary packet with a packet_length field far exceeding LIBSSH2_PACKET_MAXPAYLOAD, triggering the out-of-bounds heap write in ssh2_transport_read() and pivoting to remote code execution in the context of the SSH client process. No public exploit has been identified at time of analysis, but the upstream patch diff publicly discloses the unchecked bound, lowering the bar for exploit development.
Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.
Patch available 0.6% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 17, 2026

Remote code execution in libssh2 through version 1.11.1 stems from an unchecked packet_length field in ssh2_transport_read() that allows attackers to send oversized SSH packets and corrupt heap memory. The flaw was reported by VulnCheck and is fixed upstream in commit 97acf3df (PR #2052), which adds an upper-bound check against LIBSSH2_PACKET_MAXPAYLOAD. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 9.2 reflects pre-authentication network reach with high impact on confidentiality, integrity, and availability.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply commit 97acf3dfda80c91c3a8c9f2372546301d4a1a7a8 from https://github.com/libssh2/libssh2/pull/2052 or upgrade to the first tagged libssh2 release that includes it (post-1.11.1) once distributors publish it, and rebuild downstream consumers (curl, language bindings, container base images) against the patched library. Audit your environment for statically linked copies, since OS-level package upgrades will not cover bundled libssh2 inside third-party binaries or appliances. Until patched libraries are deployed, the practical compensating control is to restrict outbound SSH/SCP/SFTP from libssh2-using clients to a known-good allowlist of SSH servers, since exploitation requires the client to receive crafted server-side traffic; egress filtering on TCP/22 to untrusted destinations meaningfully reduces exposure but will break legitimate SSH to arbitrary hosts. Consult the VulnCheck advisory at https://www.vulncheck.com/advisories/libssh2-out-of-bounds-write-via-unchecked-packet-length-in-transport-c for additional vendor guidance.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

libssh2 is a widely embedded client-side C library implementing the SSH-2 protocol, used by curl, git, and numerous management agents and appliances to establish outbound SSH/SCP/SFTP sessions. The defect is classified as CWE-680 (Integer Overflow to Buffer Overflow): the SSH binary packet protocol prefixes each packet with a 32-bit length field, and ssh2_transport_read() in src/transport.c read this field and previously only rejected values below 1, accepting any large value up to UINT32_MAX. Downstream allocation and copy logic then operated on the attacker-controlled length, producing an out-of-bounds write on the heap. The upstream fix adds an else-if branch returning LIBSSH2_ERROR_OUT_OF_BOUNDARY when p->packet_length exceeds LIBSSH2_PACKET_MAXPAYLOAD, enforcing the protocol's intended ceiling. Because libssh2 is normally invoked as a client, the malicious peer is typically a server the victim connects to.

Know when Libssh2 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulnCheck) PRIMARY 9.2 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
vuln.today AI 8.1 HIGH

Network-reachable and unauthenticated, but exploitation requires the libssh2 client to connect to a malicious SSH server and reliable heap RCE against modern hardening raises AC to High.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat 8.1 HIGH

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
Present
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
High
Vulnerable system: Integrity
High
Vulnerable system: Availability
High
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

DescriptionCVE.org

libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.

Executive ViewAI

Why It Matters

libssh2 versions through 1.11.1 contain a critical remote code execution vulnerability (CVE-2026-55200, CVSS 9.2) exploitable by unauthenticated attackers with network access. No public exploit code has been identified at time of analysis. This directly threatens SSH-dependent infrastructure across access management, deployment pipelines, and infrastructure automation, requiring immediate patching to prevent unauthorized system compromise.

Business Impact: Severe
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.6%
Top 58% exploitable
Exploit
POC
Public exploit code exists
Social Media
1
Sightings
Data Quality
8 sources
Confidence: High
NVD CVE.org EPSS Vulnrichment MSRC Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC Yes
EPSS 0.6%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity + public POC available
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
Very High
Technical Impact
Total

Priority Score

67
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +46
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Affected Products (CPE)CVE.org

cpe:2.3:a:libssh2:libssh2:*:*:*:*:*:*:*:*

More in Libssh2

View all
CVE-2023-48795 MEDIUM POC
5.9 Dec 18

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
CVE-2019-17498 HIGH POC
8.1 Oct 21

In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds che
CVE-2026-58050 HIGH POC
8.3 Jun 28

Heap buffer overflow in the libssh2 SSH client library (all versions through 1.11.1) lets a malicious or compromised SSH
CVE-2026-58051 HIGH POC
8.3 Jun 28

Free of an uninitialized, attacker-influenceable pointer in libssh2 through 1.11.1 allows a malicious SSH server to corr
CVE-2025-15661 HIGH POC
8.3 Jun 18

Out-of-bounds heap read in libssh2 through 1.11.1 enables a malicious SFTP server or man-in-the-middle attacker to leak

CVE-2019-13115 HIGH POC
8.1 Jul 16

In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow t
CVE-2019-3862 CRITICAL
9.1 Mar 21

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exi
CVE-2019-3855 HIGH
8.8 Mar 21

An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way pa
CVE-2019-3858 CRITICAL
9.1 Mar 21

An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from

CVE-2019-3859 CRITICAL
9.1 Mar 21

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_req
CVE-2019-3861 CRITICAL
9.1 Mar 25

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value gre
CVE-2019-3860 CRITICAL
9.1 Mar 25

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed

Same weakness CWE-680 – Integer Overflow to Buffer Overflow

View all
CVE-2021-40417 CRITICAL POC
9.8
CVE-2021-21832 CRITICAL POC
9.8
CVE-2021-21783 CRITICAL POC
9.8
CVE-2018-8787 CRITICAL POC
9.8
CVE-2018-8786 CRITICAL POC
9.8
CVE-2025-32023 HIGH POC
7.0
CVE-2021-3321 HIGH POC
8.8
CVE-2021-21850 HIGH POC
8.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Server 16.0 Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Micro 5.3 Not-Affected

References

Advisories & patches
PATCH https://github.com/libssh2/libssh2/commit/97acf3dfda80c91c3a8c9f2372546301d4a1a7a8 ADVISORY https://access.redhat.com/errata/RHSA-2026:29950 ADVISORY https://seclists.org/oss-sec/2026/q2/1010 ADVISORY https://seclists.org/oss-sec/2026/q2/1011 ADVISORY https://seclists.org/oss-sec/2026/q2/1014 ADVISORY https://seclists.org/oss-sec/2026/q2/1017 ADVISORY https://ubuntu.com/security/notices/USN-8486-1 ADVISORY https://vuldb.com/vuln/372111 REF https://github.com/bikini/exploitarium/tree/main/libssh2-cve-2026-55200-poc REF https://github.com/libssh2/libssh2/pull/2052 REF https://web.archive.org/web/20260623211210/https://github.com/bikini/exploitarium/tree/main/libssh2-cve-2026-55200-poc REF https://www.vulncheck.com/advisories/libssh2-out-of-bounds-write-via-unchecked-packet-length-in-transport-c

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy