VulnSocial
← Back to blog

CVE-2026-55200 – Critical Out‑of‑Bounds Write in libssh2

Key takeaways

  • Critical out‑of‑bounds heap write in libssh2 (≤ 1.11.1) enables remote code execution on the SSH client.
  • No credentials or user interaction required; the attacker controls the SSH server.
  • Public proof‑of‑concepts are available; active exploitation has been reported on several occasions.
  • Immediate patch to a build containing commit 7acf3df (PR #2052) or upgrade to a fixed release.
  • Inventory all software that statically links libssh2 (curl, Git, PHP, network appliances) and apply mitigations.

Overview

  • Identifier: CVE-2026-55200
  • Vendor / Product: libssh2 library (SSH client implementation)
  • Published: 2026‑06‑17 (NVD)
  • Severity: Critical (CVSS 4.0 9.2, NIST CVSS 3.1 8.3)
  • CWE: CWE‑680 (Integer overflow / out‑of‑bounds write)
  • CISA KEV: Not listed

The vulnerability affects all releases of libssh2 up to and including 1.11.1. It was disclosed by the NHS Digital Cyber Security team and quickly attracted public PoC code and discussion across security communities.

Technical Details

The flaw resides in the function ssh2_transport_read(), which processes inbound SSH packets. The implementation fails to enforce the maximum allowed packet_length as defined by the SSH RFC. An attacker‑controlled SSH server can therefore send a packet with a deliberately inflated length field. The client library copies the oversized payload into a fixed‑size heap buffer, causing an out‑of‑bounds write that can corrupt adjacent memory structures.

Attack flow

  1. Victim initiates an outbound SSH connection (e.g., via ssh, scp, sftp, or any application that embeds libssh2).
  2. The remote SSH server (or a man‑in‑the‑middle) sends a crafted packet with a malicious packet_length.
  3. libssh2 reads the packet without proper bounds checking, writing beyond the allocated buffer.
  4. Controlled heap corruption leads to remote code execution on the client host, without requiring authentication or user interaction.

Because the vulnerability is triggered on the client side, any service that initiates outbound SSH connections becomes an attack surface, reversing the traditional server‑focused threat model.

Severity & Impact

  • CVSS 4.0: 9.2 / Critical – Network‑only, low attack complexity, privileged‑level impact on confidentiality, integrity, and availability.
  • NIST CVSS 3.1: 8.3 / High – Same vector with slightly higher required user interaction.

The combination of no authentication required, remote code execution, and wide adoption of libssh2 in popular tools (curl, Git, PHP, various network appliances) makes this a high‑impact vulnerability that can lead to full system compromise.

Affected Products

  • libssh2 library ≤ 1.11.1 (all platforms).
  • Applications that statically or dynamically link the vulnerable library, including but not limited to:
    • curl (SSH/SCP support)
    • Git (SSH transport)
    • PHP extensions that use libssh2 for SFTP
    • Embedded network appliances and custom binaries that bundle libssh2

For a complete list of affected products and versions, see the detailed inventory on the VulnSocial CVE page.

Actionable Insights – What to Do Now

  • Inventory every binary on your network that includes libssh2 (use ldd, strings, or SBOM tools).
  • Upgrade to a build that contains commit 7acf3df (see the patch reference) or to a later official release that incorporates the fix.
  • Rebuild any internally developed software that statically links the library with the patched source.
  • Deploy IDS/IPS signatures that flag SSH packets with a packet_length exceeding the RFC maximum (≈ 256 KB).
  • Monitor outbound SSH traffic for anomalous packet sizes or unexpected server responses.
  • Disable libssh2‑based SSH/SCP/SFTP functionality on systems where it is not required.
  • Track emerging intelligence (new PoCs, exploitation reports) via the live threat feed on VulnSocial.

Remediation & Mitigation (Step‑by‑Step)

  1. Apply the official patch – commit 7acf3df (PR #2052).
  2. Upgrade the library to a version that includes the patch (≥ 1.11.2 or later).
  3. Recompile any applications that statically embed libssh2 with the patched source.
  4. Validate the runtime library version (e.g., ldd, objdump -p, or strings on the binary).
  5. Implement network detection for oversized SSH packets (e.g., Snort/Suricata rule: ssh packet_length > 262144).
  6. Restrict outbound SSH where possible; use jump hosts or SSH proxies that enforce strict packet validation.
  7. Maintain an up‑to‑date SBOM and schedule regular vulnerability scans to catch future libssh2 updates.

Bottom Line

CVE-2026-55200 is a Critical out‑of‑bounds write in the widely used libssh2 client library that enables remote code execution without credentials. Public PoCs exist and active exploitation has been reported, so immediate patching and inventory of affected binaries are essential to prevent compromise.

References

#CVE202655200 #Critical #RCE #libssh2 #CWE680