CVE-2026-55199Disclosure(libssh2 / libssh2)

HIGHCVSS 7.5 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Patch libssh2 libssh2 systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can set nr_extensions to 0xFFFFFFFF during key exchange, causing the client to spin in a tight CPU loop for over 60 seconds because return values from _libssh2_get_string() are unchecked and the session timeout does not apply to CPU-bound loops.

libssh2 CVEs Back to dashboard

7.8/ 10 priority

Sources & remediation

Patch / fix

Vendor / third-party advisories

https://www.vulncheck.com/advisories/libssh2-pre-authentication-dos-via-ssh-msg-ext-info-handler

Weakness type (CWE)

CWE-835

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

libssh2

Threat summary

Active exploitation appears in 1 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
12 mentions across 9 observed days

What's happening

Active exploitation reported across 1 signal
Exploit tool or code specified in 3 signals
PoC mentioned or linked in 4 signals
Patch or workaround mentioned in 6 signals
Technical details provided in 9 signals
Disclosure: 5 classified signals
General: 3 classified signals
Peaked 8d ago at 2 mentions (2026-06-17); latest day: 1
12 total mentions across 9 days

Affected systems

Vendors

libssh2

Products

libssh2

Deep dive

Activity timeline12 mentions / 9d

Signal classification5 categories

Disclosure

541.7%

General

325.0%

Patch

216.7%

PoC

18.3%

Exploit

18.3%

Referenced assets21 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-17	2	General1Patch1
2026-06-22	2	Disclosure2
2026-06-23	1	Disclosure1
2026-06-24	1	Disclosure1
2026-06-25	2	General1PoC1
2026-06-27	1	General1
2026-06-30	1	Patch1
2026-07-10	1	Exploit1
2026-07-14	1	Disclosure1

Full discourse12 posts

Open Source Security mailing list@oss_security85d
PoC
libssh2: CVE-2026-55200 (critical), CVE-2025-15661 (high), CVE-2026-55199 (high) https://www.openwall.com/lists/oss-security/2026/06/23/10 libssh2 CVE-2026-55200 PoC and local RCE scaffold https://www.openwall.com/lists/oss-security/2026/06/23/11
Post summary
The post announces three libssh2 CVEs and shares a proof‑of‑concept plus a local RCE scaffold for CVE‑2026‑55200, indicating the vulnerability has a publicly available PoC.
020721.1K
4.7K followersView on X
p19k@peteralexbizjak87d
Disclosure
Wild vulnerabilities found in libssh2. I'll paste the descriptions from NIST below. CVE-2026-55200: libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution. CVE-2026-55199; libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can set nr_extensions to 0xFFFFFFFF during key exchange, causing the client to spin in a tight CPU loop for over 60 seconds because return values from _libssh2_get_string() are unchecked and the session timeout does not apply to CPU-bound loops.
Post summary
The post announces two new libssh2 vulnerabilities, outlining RCE and DoS vectors and noting that patches are available, without providing PoC or exploitation details.
10020269
1.4K followersView on X
CERT-PY@CERTpy65d
Disclosure
⚠️ Vulnerabilidades en productos SSH ❗ CVE-2026-55200 ❗ CVE-2026-55199 ❗ CVE-2025-15661 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-ssh/ https://t.co/9p3ghUfVJj
Post summary
The post lists three SSH-related CVEs and links to a government site for additional information.
01001292
6.7K followersView on X
Rama@dntyk70d
Exploit
Celah kritis di libssh2. CVSS 9.2. RCE tanpa autentikasi. Penyerang cukup kirim SSH packet ukuran gila buat corrupt heap memory dan execute code dari jauh. No auth, no user interaction. PoC exploit-nya udah rilis. Jadi ini bukan teori lagi. 1. CVE-2026-55200 (9.2), RCE via ssh2_transport_read(), integer overflow jadi buffer overflow. 2. CVE-2026-55199 (8.2), DoS, CPU lumpuh saat connect ke server malicious. Yang bikin parah, libssh2 bukan library obscure. Ini dipake di curl, tool backup, IoT devices. Ekosistem downstream-nya masif. Semua versi sampe 1.11.1 kena. Patch udah di GitHub. Kalau lo manage server, update sekarang. https://cybernews.com/security/libssh2-critical-vulnerability-enables-rce/
Post summary
Critical RCE in libssh2 with released PoC and available patch, urging immediate update across affected versions.
00010587
13.7K followersView on X
Mr. OS@ksg93rd82d
General
#Analytics #Threat_Research An analytical review of the main cybersecurity events (June 1-26, 2026) http://www.cyberpocket.org 1⃣. Old Bug, Harder Rules: Exploiting CVE-2023-36802 Without the Usual Shortcuts https://starlabs.sg/blog/2026/06-old-bug-harder-rules-exploiting-cve-2023-36802-without-the-usual-shortcuts // Type confusion bug in Microsoft’s Streaming Service 2⃣. Dissecting and Exploiting Linux LPE Variant: DirtyClone (CVE-2026-43503) https://research.jfrog.com/post/dissecting-and-exploiting-linux-lpe-variant-dirtyclone-cve-2026-43503 // CVE-2026-43503 https://github.com/rafaeldtinoco/security/tree/main/exploits/dirtyclone is a workaround for Dirty Frag vulnerability in xfrm-ESP module, which is used to accelerate encryption operations in IPsec using ESP 3⃣. Patch the Planet: a Daybreak initiative to support open source maintainers https://openai.com/index/patch-the-planet 4⃣. StrikeShark malware loader https://securelist.com/strikeshark-campaign/120326 // malware loader used in StrikeShark campaign to deploy Cobalt Strike Beacons via DLL hijacking and encrypted stages 5⃣. NGINX ngx_http_v3_module vulnerability https://my.f5.com/manage/s/article/K000161616 // CVE-2026-42530 https://github.com/0xBlackash/CVE-2026-42530 6⃣. BOD 26-04: Prioritizing Security Updates Based on Risk https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk 7⃣. AMD will reinstate memory encryption on Ryzen 9000 CPUs through a BIOS update in July https://www.tomshardware.com/pc-components/cpus/amd-will-reinstate-memory-encryption-on-ryzen-9000-cpus-through-a-bios-update-in-july-tsme-is-coming-back-after-valuable-community-feedback 8⃣. libssh2 vulnerabilities https://www.secure-iss.com/newsroom/libssh2-critical-vulnerabilities-rce-dos // Out-of-Bounds Write via Unchecked packet_length in transport.c (CVE-2026-55200, CVE-2026-55199) 9⃣. HallWatch user mode detector https://github.com/Zypherion-Technologies/HallWatch // Usermode detector that catches indirect syscalls. Traps Hell's Hall, Tartarus' Gate, RecycledGate, VEH syscalls & more 🔟 AI SOC Evaluation Framework https://secops-unpacked.ai/asef/guide
Post summary
The report is a broad analytical roundup covering multiple CVEs, including PoC code, exploit details, active deployment evidence, and patch information, but lacks a single central focus.
00001319
3.3K followersView on X
Cyber Kendra@cyberkendra86d
Disclosure
There's also CVE-2026-55199 — CVSS 8.2 A malicious SSH server can lock a connecting client in a CPU loop for 60+ seconds by sending a crafted extension count during handshake. Automated pipelines and monitoring agents are especially exposed.
Post summary
A newly disclosed SSH denial‑of‑service vulnerability (CVE-2026‑55199) enables a malicious server to lock clients in a CPU loop by sending a crafted extension count during handshake, posing a risk especially to automated pipelines and monitoring agents.
1000070
1.5K followersView on X
CyberTLDR@CyberTLDR79d
Patch
3/3 No release yet but patch commit 97acf3d is in mainline. Debian is backporting it. Inventory static libssh2 copies package managers miss. Restrict outbound SSH to trusted hosts. Also patch CVE-2026-55199 (8.2) and CVE-2025-15661 (8.3). #patchnow #SSH #cybersecurity
Post summary
The post announces that patches for CVE‑2026‑55199 and CVE‑2025‑15661 are available (commit 97acf3d), with Debian backporting, and urges restricting outbound SSH.
0000044
16 followersView on X
castris.com@CastrisES85d
General
"La cadena es tan frágil como el eslabón mas débil" Eso esta bien en #SeguridadInformatica Caterva de #expertos con stick azul, cuentas en #Linkedin (hoguera de las vanidades) hablando de #libssh2 para CVE-2026-55200 y CVE-2026-55199 Lee tu infra, analiza y actua. (90% humo) https://t.co/CrVFdpIQqa
Post summary
The post lightly references CVE-2026-55200 and CVE-2026-55199 related to libssh2 but offers no PoC, exploit, technical detail, or evidence of real‑world attacks, making it a generic commentary rather than actionable intel.
0000060
16 followersView on X
NewMaxx@NewMaxxSSD86d
Disclosure
libssh2 Client-Side Heap-Overflow RCE (CVE-2026-55200) and Pre-Auth DoS (CVE-2026-55199) Direct: https://ift.tt/aQGgJm1 https://ift.tt/BIX9F8d
Post summary
A tweet announces two new libssh2 client‑side vulnerabilities—a heap‑overflow RCE and a pre‑authentication DoS—and provides links for additional information.
0000066
656 followersView on X
TECHEPAGES@techepages88d
Disclosure
🚨 Critical libssh2 bugs found: CVE-2026-55200 (9.2) — out-of-bounds write → remote code execution, no auth needed CVE-2026-55199 (8.2) — malicious SSH server can freeze clients for 60+ sec Affected: v1.11.1 and earlier curl (via SCP/SFTP) Backup tools, IoT/network devices Patches exist on GitHub, but no official release yet.
Post summary
The tweet reports two critical CVEs in libssh2 with detailed impact and notes that GitHub‑hosted patches are available but not yet officially released.
0000093
15 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds92d
General
CVE-2026-55199 Pre-Authentication Denial of Service in libssh2 Through 1.11.1 SSH_MSG_EXT_INFO Handler https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-55199
Post summary
The note references CVE-2026-55199, detailing a pre‑authentication Denial of Service in libssh2 through 1.11.1 via the SSH_MSG_EXT_INFO handler, with no information on PoC, exploitation, or mitigation.
0000064
4.0K followersView on X
CVE@CVEnew92d
Patch
CVE-2026-55199 libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that al… https://www.cve.org/CVERecord?id=CVE-2026-55199
Post summary
The post informs that libssh2 versions up to 1.11.1 contain a pre‑authentication denial of service vulnerability, which has been fixed in commit 1762685.
00000154
57.6K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	libssh2	libssh2	-	-	-

Explore more

Back to dashboard libssh2 CVEs libssh2 vulnerabilities

What researchers are saying

CVE-2026-55199

p19k[verified]@peteralexbizjakDisclosure

The post announces two new libssh2 vulnerabilities, outlining RCE and DoS vectors and noting that patches are available, without providing PoC or exploitation details.

Rama[verified]@dntykExploit

Critical RCE in libssh2 with released PoC and available patch, urging immediate update across affected versions.

NewMaxx[verified]@NewMaxxSSDDisclosure

A tweet announces two new libssh2 client‑side vulnerabilities—a heap‑overflow RCE and a pre‑authentication DoS—and provides links for additional information.

TECHEPAGES[verified]@techepagesDisclosure

The tweet reports two critical CVEs in libssh2 with detailed impact and notes that GitHub‑hosted patches are available but not yet officially released.

Open Source Security mailing list@oss_securityPoC

The post announces three libssh2 CVEs and shares a proof‑of‑concept plus a local RCE scaffold for CVE‑2026‑55200, indicating the vulnerability has a publicly available PoC.

CERT-PY@CERTpyDisclosure

The post lists three SSH-related CVEs and links to a government site for additional information.

Mr. OS@ksg93rdGeneral

The report is a broad analytical roundup covering multiple CVEs, including PoC code, exploit details, active deployment evidence, and patch information, but lacks a single central focus.

Cyber Kendra@cyberkendraDisclosure

A newly disclosed SSH denial‑of‑service vulnerability (CVE-2026‑55199) enables a malicious server to lock clients in a CPU loop by sending a crafted extension count during handshake, posing a risk especially to automated pipelines and monitoring agents.