Security Report: CVE-2026-55200

📝 General Description

CVE-2026-55200 is a critical heap-based buffer overflow vulnerability (dynamic memory corruption) affecting the libssh2 library in versions up to 1.11.1.

It allows a malicious SSH server to compromise vulnerable clients that connect to it.

---

⚡ Technical Details

• Vulnerability type: Heap-based Buffer Overflow.
• Main impact: Remote Code Execution (RCE) and Denial of Service (DoS).
• Attack phase: Occurs before cryptographic authentication.
• Attack vector: A malicious or intercepted SSH server sends a packet with an excessive length, overflowing the allocated buffer on the client.

---

🏗️ Supply Chain Impact

This vulnerability has a massive reach because libssh2 is used by multiple popular tools and languages:

• curl (when compiled with SSH support via libssh2).
• Git (used in development environments and CI/CD pipelines).
• PHP (through extensions that consume this library).

⚠️ Critical note: Many of these tools integrate the library statically, meaning that updating the operating system does not always fix the problem in the application.