CVE-2026-55200PoC(libssh2 / libssh2)

CRITICALCVSS 8.3 · HIGH

Exploitation observed; activity peaked at 28 mentions and remains active

Immediate actions

Patch libssh2 libssh2 systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.

libssh2 CVEs Back to dashboard

8.5/ 10 priority

Sources & remediation

Patch / fix

Exploit / PoC references

https://web.archive.org/web/20260623211210/https://github.com/bikini/exploitarium/tree/main/libssh2-cve-2026-55200-poc

Vendor / third-party advisories

https://www.vulncheck.com/advisories/libssh2-out-of-bounds-write-via-unchecked-packet-length-in-transport-c

Weakness type (CWE)

CWE-680

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

libssh2

Threat summary

Active exploitation appears in 6 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
132 mentions across 23 observed days

What's happening

Active exploitation reported across 6 signals
Exploit tool or code specified in 34 signals
PoC mentioned or linked in 82 signals
Patch or workaround mentioned in 33 signals
Technical details provided in 102 signals
Disclosure: 30 classified signals
Peaked 15d ago at 28 mentions (2026-06-29); latest day: 2
132 total mentions across 23 days

Affected systems

Vendors

libssh2

Products

libssh2

1 version affected across 1 product

Deep dive

Activity timeline132 mentions / 23d

Signal classification6 categories

PoC

7355.3%

Disclosure

3022.7%

Patch

139.8%

General

86.1%

Active Exploitation

64.5%

Exploit

21.5%

Referenced assets72 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-17	2	Disclosure1Patch1
2026-06-18	1	Active Exploitation1
2026-06-22	5	Disclosure4General1
2026-06-23	23	Active Exploitation1Disclosure7General3Patch6PoC6
2026-06-24	7	Disclosure4PoC3
2026-06-25	4	General1PoC3
2026-06-27	4	Exploit1Patch1PoC2
2026-06-29	28	Disclosure2PoC26
2026-06-30	12	Active Exploitation1Disclosure2General1Patch1PoC7
2026-07-01	5	Patch1PoC4
2026-07-02	3	Disclosure2PoC1
2026-07-04	1	Disclosure1
2026-07-05	3	PoC3
2026-07-06	3	Disclosure1Patch2
2026-07-07	1	PoC1
2026-07-10	2	Exploit1PoC1
2026-07-11	1	Active Exploitation1
2026-07-13	2	Patch1PoC1
2026-07-14	7	Disclosure5General2
2026-07-15	6	Active Exploitation1PoC5
2026-07-18	9	Active Exploitation1PoC8
2026-07-20	1	Disclosure1
2026-07-21	2	PoC2

Full discourse20 posts

International Cyber Digest@IntCyberDigest132d
Patch
‼️🚨 Critical remote code execution in libssh2, the SSH client library embedded in countless tools: CVE-2026-55200, rated CVSS 9.2 by VulnCheck. Every version up to and including 1.11.1 is affected. It's an out-of-bounds heap write in ssh2_transport_read(), which fails to bound-check the SSH packet_length field. A malicious or MITM'd SSH server can send oversized packets to corrupt memory and run code on the connecting client. No known exploitation yet and it's not in CISA's KEV. Fix: move to a build that includes commit 7acf3df (PR #2052), and inventory anything that links libssh2 for SSH, SCP, or SFTP.
Post summary
The tweet alerts to CVE-2026‑55200, an out‑of‑bounds heap write in libssh2, stresses that no exploitation is known, and recommends upgrading to a build containing commit 7acf3df to mitigate the risk.
27311331.6K647252.6K
207.8K followersView on X
The Hacker News@TheHackersNews126d
PoC
🚨 CVE-2026-55200 now has public PoC code. The libssh2 flaw lets a malicious SSH server trigger memory corruption in a connecting client. > No credentials > No user interaction > Affected through libssh2 1.11.1 The real cleanup problem is finding bundled and static copies in curl, Git, PHP, and appliances. Learn more ➝ https://thehackernews.com/2026/06/public-poc-released-for-critical.html
Post summary
CVE‑2026‑55200 is now publicly documented with PoC code that demonstrates memory corruption in libssh2 1.11.1, but no active exploitation or patch information is reported.
10834341161117.4K
2.3M followersView on X
International Cyber Digest@IntCyberDigest132d
PoC
‼️🚨 Proof-of-Concept code has just been released for this vulnerability: https://github.com/bikini/exploitarium/tree/main/libssh2-cve-2026-55200-poc
Post summary
The tweet announces that a Proof‑of‑Concept code for CVE‑2026‑55200 has been released, providing a GitHub link to the corresponding repository.
373034415352.9K
207.8K followersView on X
Dark Web Informer@DarkWebInformer131d
PoC
🚨 Here is another PoC for CVE-2026-55200 - Critical libssh2 Out-of-Bounds Write Vulnerability PoC: https://github.com/0xBlackash/CVE-2026-55200 https://t.co/WrVDCTrcQQ
Post summary
A PoC for CVE-2026-55200, a critical libssh2 out‑of‑bounds write vulnerability, has been posted on GitHub, demonstrating the issue.
23511477923.1K
226.8K followersView on X
Dark Web Informer@DarkWebInformer132d
PoC
🚨 CVE-2026-55200: libssh2 through 1.11.1 accepted an attacker-controlled SSH packet length in one full-packet decryption path without first enforcing the RFC-sized libssh2 packet maximum. PoC on GitHub: https://github.com/bikini/exploitarium/tree/main/libssh2-cve-2026-55200-poc https://t.co/IDveIljNwq
Post summary
A proof‑of‑concept for CVE‑2026‑55200 is publicly available, demonstrating how libssh2 can be abused to accept attacker‑controlled packet lengths, but there is no evidence of active exploitation or remediation.
1281943519.6K
226.8K followersView on X
Nicolas Krassas@Dinosn126d
PoC
Public PoC Released for Critical libssh2 CVE-2026-55200 Client-Side SSH Flaw https://thehackernews.com/2026/06/public-poc-released-for-critical.html
Post summary
The article announces a publicly available Proof of Concept for the critical libssh2 client‑side SSH flaw (CVE‑2026‑55200), with no mention of active exploitation, patches, or false‑positive status.
214083195.8K
160.5K followersView on X
elhacker.NET@elhackernet131d
Disclosure
Vulnerabilidad crítica en libssh2 permite ejecución remota de código mediante paquetes SSH maliciosos Se ha identificado una vulnerabilidad de seguridad crítica en la biblioteca libssh2 , identificada como CVE-2026-55200 https://blog.elhacker.net/2026/06/vulnerabilidad-critica-en-libssh2.html
Post summary
The text announces a critical remote code execution vulnerability in libssh2 (CVE-2026-55200) that exploits malicious SSH packets, with no evidence of available exploits, active attacks, or mitigations.
114059225.2K
141.3K followersView on X
Vivek | Cybersecurity@VivekIntel126d
PoC
Public PoC Released for Critical libssh2 CVE-2026-55200 Client-Side SSH Flaw https://thehackernews.com/2026/06/public-poc-released-for-critical.html?m=1
Post summary
A proof‑of‑concept for the critical libssh2 CVE‑2026‑55200 client‑side SSH flaw has been publicly released, with no evidence of active exploitation or availability of a patch.
17025122.7K
18.1K followersView on X
Teegra 🧝‍♀️𝕏@Teeegra126d
PoC
یک آسیب‌پذیری بحرانی در کتابخانه libssh2 با شناسه CVE-2026-55200 و امتیاز CVSS 9.2 کشف شده است که اکنون کد اثبات مفهوم (proof-of-concept) عمومی برای آن منتشر شده است. این نقص در تابع `ssh2_transport_read()` قرار دارد و به یک سرور SSH مخرب اجازه می‌دهد بدون نیاز به احراز هویت یا تعامل کاربر، از طریق سرریز عدد صحیح (integer overflow) به سرریز بافر (buffer overflow) در حافظه heap کلاینت متصل‌شونده دست یابد و احتمالاً کد دلخواه اجرا کند. این آسیب‌پذیری تمام نسخه‌های libssh2 تا 1.11.1 را تحت تأثیر قرار می‌دهد و از آنجا که این کتابخانه به‌صورت ایستا (statically linked) در ابزارهایی مانند curl، Git، PHP، عوامل پشتیبان‌گیری و سیستم‌افزارها (firmware) تعبیه شده به‌روزرسانی بسته‌های توزیع لینوکس به‌تنهایی کافی نیست! هنوز نسخه رسمی اصلاح‌شده‌ای از libssh2 منتشر نشده!
Post summary
A critical CVE-2026-55200 in libssh2 was disclosed with a publicly available PoC; no patch exists and there is no evidence of active exploitation.
0413252.0K
19.3K followersView on X
Xavier Rivera@XavierRiveraX126d
PoC
CVE-2026-55200 in libssh2 has a public PoC. CVSS 9.2, all releases up to 1.11.1 affected. A rogue SSH server can corrupt client memory before authentication. No credentials needed. Git clients, CI/CD agents, and SFTP tools built on libssh2 need an urgent patch.
Post summary
A public proof of concept exists for CVE-2026-55200, a severe memory corruption flaw in libssh2 affecting all releases up to 1.11.1, and an urgent patch is required for impacted clients.
162933.4K
601 followersView on X
RIFFSEC@getriffsec132d
Disclosure
🚨 libssh2 i RCE To nie jest kolejna luka w serwerze SSH. Tym razem problem może być po stronie klienta, który łączy się z niewłaściwym serwerem. CVE-2026-55200 dotyczy libssh2, popularnej biblioteki używanej przez aplikacje, narzędzia, integracje i automatyzacje korzystające z SSH/SFTP. Podatne są wersje do 1.11.1 włącznie. Problem siedzi w funkcji ssh2_transport_read(). Biblioteka nie pilnuje prawidłowo górnej granicy pola packet_length, więc złośliwy serwer SSH może wysłać spreparowane pakiety, uszkodzić pamięć sterty i potencjalnie doprowadzić do zdalnego wykonania kodu po stronie klienta. Nie mówimy tu o prostym scenariuszu, w którym ktoś skanuje internet i przejmuje serwery SSH. Bardziej niebezpieczne są przypadki, w których firmowe narzędzia, skrypty, backupy, deploye, integracje albo klient SFTP łączą się z przejętym, podstawionym lub złośliwym serwerem. Przy takich podatnościach najtrudniejsze często nie jest samo załatanie. Najtrudniejsze jest ustalenie, gdzie dana biblioteka naprawdę żyje. Źródła: VulnCheck, CVE, GitHub Advisory Database, NVD
Post summary
The post announces CVE-2026-55200, a remote code execution vulnerability in libssh2 caused by unchecked packet_length handling in the ssh2_transport_read() function, impacting versions up to 1.11.1, with no PoC, exploit, or patch information provided.
0001211.9K
3.0K followersView on X
Open Source Security mailing list@oss_security131d
PoC
libssh2: CVE-2026-55200 (critical), CVE-2025-15661 (high), CVE-2026-55199 (high) https://www.openwall.com/lists/oss-security/2026/06/23/10 libssh2 CVE-2026-55200 PoC and local RCE scaffold https://www.openwall.com/lists/oss-security/2026/06/23/11
Post summary
The snippet announces a critical RCE vulnerability in libssh2 (CVE-2026-55200) and provides a link to a PoC and local RCE scaffold, but does not mention active exploitation, patches, or debunking.
020721.1K
4.7K followersView on X
Daily CyberSecurity@the_yellow_fall133d
Patch
A critical libssh2 vulnerability, CVE-2026-55200, lets remote attackers trigger an out-of-bounds write and achieve remote code execution. Patch now. #libssh2 #CVE202655200 #RCE #SSH #infosec #vulnerability https://securityonline.info/libssh2-vulnerability-cve-2026-55200 https://t.co/YjdAjB7w4n
Post summary
Critical libssh2 vulnerability CVE-2026-55200 permits out-of-bounds writes and remote code execution; a patch is now available.
01073759
12.8K followersView on X
DEEPAK TAK@xd_20111126d
PoC
@TheHackersNews https://github.com/xd20111/CVE-2026-55200
Post summary
The tweet links to a GitHub repository that presumably hosts a proof‑of‑concept or exploit for CVE‑2026‑55200, with no further contextual details such as active abuse or patch status.
00034643
110 followersView on X
Adam@seoscottsdale132d
Active Exploitation
1/6 🚨 Today’s top signals from the June 23 AI Security & Cyber Brief: • Joomla JCE RCE (CVE-2026-48907) – CISA added to KEV June 16. Actively exploited. Unauthenticated attackers upload PHP via profile import endpoint → full RCE on ≤2.9.99.4. Automated scans hitting ~2.5M Joomla sites. Patch to ≥2.9.99.5 (latest is 2.9.99.7) now. • libssh2 RCE (CVE-2026-55200, CVSS 9.2) – Critical out-of-bounds write via unchecked packet_length. Disclosed ~June 17-18, heavy coverage today. Unaffected auth RCE via crafted SSH packets. Fixed in commit 7acf3df. Affects millions of systems (Linux, cloud images, CI/CD, automation, embedded). Both are live supply-chain vectors with massive downstream blast radius.
Post summary
The brief reports two actively exploited CVEs—Joomla JCE RCE and libssh2 RCE—providing technical details, active exploitation status, and patch guidance.
60000212
12.4K followersView on X
kokumօtօ@__kokumoto133d
Patch
libssh2に重大(Critical)な脆弱性。CVE-2026-55200はCVSSv4スコア9.2の境界外書き込み。transport.cのpacket_lengthにおける検証不足に起因。修正パッチありを https://securityonline.info/libssh2-vulnerability-cve-2026-55200/
Post summary
The entry reports a critical out‑of‑bounds write flaw in libssh2 (CVE‑2026‑55200), provides technical details along with a CVSS score, and indicates that a patch is available at the provided URL.
010501.0K
7.7K followersView on X
いけむらさん@fd0120d
PoC
匿名の研究者がゼロデイ数件をGitHubリポジトリで公開（CVE-2026-55200、CVE-2026-20896） | Codebook｜Security News https://codebook.machinarecord.com/threatreport/silobreaker-cyber-alert/46394/
Post summary
An anonymous researcher released PoC code for CVE‑2026‑55200 and CVE‑2026‑20896 on GitHub, sharing the zero‑day exploits publicly.
00032561
2.1K followersView on X
iototsecnews@iototsecnews126d
Disclosure
libssh2 の脆弱性 CVE-2026-55200 が FIX：細工された SSH パケットによる RCE の恐れ https://iototsecnews.jp/2026/06/23/critical-libssh2-vulnerability-lets-remote-attackers-execute-code-via-crafted-ssh-packets/ 多くのシステムで使われている libssh2 ライブラリの、深刻な脆弱性である CVE-2026-55200 について解説する記事です。この問題の主な原因は、プログラムが受信するデータの長さを確認する仕組みの不備にあります。具体的には、パケットのサイズを処理する関数において、送られてきたデータのサイズを確認する、境界チェックが不足していました。そのため、データの大きさを計算する際に整数オーバーフローが発生し、あらかじめ用意されたメモリの領域を超えてデータが書き込まれてしまいます。ご利用のチームは、ご注意ください。 #CVE202655200 #libssh2 #Vulnerability
Post summary
The article announces and explains the CVE-2026-55200 vulnerability in libssh2, describing the integer overflow and potential RCE via crafted SSH packets, but it does not provide a PoC, exploitation details, or patch information.
01021137
511 followersView on X
Misbar | مسبار@MisbarSec130d
PoC
📌 استغلال تجريبي لثغرة تنفيذ الأكواد عن بعد في libssh2 أصبح متاحًا تم إصدار استغلال تجريبي لثغرة libssh2 الحرجة لتنفيذ الأكواد عن بعد، والتي تم تعقبها كـ CVE-2026-55200. تؤثر هذه الثغرة على إصدارات libssh2 حتى 1.11.1 وتوجد في وظيفة ssh2_transport_read()، التي تقوم بتحليل حزم SSH الواردة من جانب العميل. يزيد توافر الاستغلال التجريبي من خطر الهجمات الفعلية على الأنظمة غير المصححة. يُنصح بتحديث الأنظمة وتطبيق التصحيحات الأمنية على الفور. 🔗 للمزيد: https://cybersecuritynews.com/?p=153720
Post summary
A proof‑of‑concept exploit for CVE‑2026‑55200 in libssh2 has been published, detailing the vulnerable function and urging immediate patching.
00040504
363 followersView on X
Eric Taylor@bcs_erictaylor131d
Disclosure
🚨 CVE-2026-55200 🚨 Description: libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution. EPSS Lookup: https[:]//epsslookuptool[.]com/?cve=CVE-2026-55200 PoC Posted on Github: https[:]//github[.]com/bikini/exploitarium/tree/main/libssh2-cve-2026-55200-poc References: https[:]//github[.]com/libssh2/libssh2/commit/97acf3dfda80c91c3a8c9f2372546301d4a1a7a8 https[:]//github[.]com/libssh2/libssh2/pull/2052 https[:]//www.vulncheck[.]com/advisories/libssh2-out-of-bounds-write-via-unchecked-packet-length-in-transport-c
Post summary
The post announces CVE-2026-55200, details the out-of-bounds write vulnerability, provides a PoC and notes a fix via a specific commit.
01021245
692 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	libssh2	libssh2	1.11.1	-	-

Explore more

Back to dashboard libssh2 CVEs libssh2 vulnerabilities

What researchers are saying

CVE-2026-55200

International Cyber Digest[verified]@IntCyberDigestPatch

The tweet alerts to CVE-2026‑55200, an out‑of‑bounds heap write in libssh2, stresses that no exploitation is known, and recommends upgrading to a build containing commit 7acf3df to mitigate the risk.

International Cyber Digest[verified]@IntCyberDigestPoC

The tweet announces that a Proof‑of‑Concept code for CVE‑2026‑55200 has been released, providing a GitHub link to the corresponding repository.

Nicolas Krassas[verified]@DinosnPoC

The article announces a publicly available Proof of Concept for the critical libssh2 client‑side SSH flaw (CVE‑2026‑55200), with no mention of active exploitation, patches, or false‑positive status.

Vivek | Cybersecurity[verified]@VivekIntelPoC

A proof‑of‑concept for the critical libssh2 CVE‑2026‑55200 client‑side SSH flaw has been publicly released, with no evidence of active exploitation or availability of a patch.

Teegra 🧝‍♀️𝕏[verified]@TeeegraPoC

A critical CVE-2026-55200 in libssh2 was disclosed with a publicly available PoC; no patch exists and there is no evidence of active exploitation.

Xavier Rivera[verified]@XavierRiveraXPoC

A public proof of concept exists for CVE-2026-55200, a severe memory corruption flaw in libssh2 affecting all releases up to 1.11.1, and an urgent patch is required for impacted clients.

RIFFSEC[verified]@getriffsecDisclosure

The post announces CVE-2026-55200, a remote code execution vulnerability in libssh2 caused by unchecked packet_length handling in the ssh2_transport_read() function, impacting versions up to 1.11.1, with no PoC, exploit, or patch information provided.

Adam[verified]@seoscottsdaleActive Exploitation

The brief reports two actively exploited CVEs—Joomla JCE RCE and libssh2 RCE—providing technical details, active exploitation status, and patch guidance.