A public proof-of-concept is now available for CVE-2026-55200, a critical flaw in libssh2 that lets a malicious SSH server trigger memory corruption on a connecting client. No credentials needed. No user interaction. The bug affects every release up to and including 1.11.1 and carries a CVSS 4.0 score of 9.2.
libssh2 is a client-side SSH library, not a server. That distinction matters because it’s embedded in curl, Git, PHP, backup agents, firmware updaters, and many other tools. Anything that links it and connects to an untrusted SSH endpoint is a potential target. Many of those copies are statically linked, so a distro package update won’t touch them. You might not even know they’re there.
The bug lives in ssh2_transport_read() in transport.c, the function that parses incoming SSH packets during the handshake. It reads the attacker-controlled packet_length field and only rejects values below 1. There’s no upper bound check. A length of 0xffffffff wraps around to a tiny number in 32-bit arithmetic. libssh2 allocates a buffer sized for that tiny number, then later code writes the full oversized packet into it. The result is an out-of-bounds heap write — a classic primitive for code execution.
libssh2 has seen this before. In 2019, version 1.8.1 fixed a batch of nine flaws including CVE-2019-3855, a near-identical integer overflow in the same transport read function. Seven years later, the same class of bug is back in the same code.
There’s no fixed release yet. The patch sits in mainline source, and distributions are backporting it themselves. Debian already has a repaired build in testing. Until you can patch, restrict outbound SSH connections to trusted servers and verify host keys. Inventory everything that links libssh2, including static or bundled copies that package managers won’t flag.
Also patch CVE-2026-55199 (CVSS 8.2), a denial of service via bogus extension count, and CVE-2025-15661 (CVSS 8.3), an SFTP heap over-read.
