xd20111/cve-2026-55200Detailed analysis of a critical pre-authentication out-of-bounds write vulnerability in libssh2 leading to remote code execution, with root cause, detection, and mitigation guidance.
Critical Pre-Authentication Memory Corruption Vulnerability in libssh2
| Field | Detail |
|---|---|
| CVE | CVE-2026-55200 |
| CVSS | 9.2 Critical |
| Type | Out-of-Bounds Write |
| Component | libssh2 |
| Affected Versions | <= 1.11.1 |
| Attack Vector | Network |
| Privileges Required | None |
| User Interaction | None |
| Impact | Remote Code Execution (RCE), Denial of Service (DoS) |
| Fixed In | Commit 97acf3dfda80c91c3a8c9f2372546301d4a1a7a8 |
| Disclosure Date | June 2026 |
CVE-2026-55200 is a critical memory corruption vulnerability affecting the widely deployed libssh2 library.
The flaw exists in the SSH transport layer packet processing logic inside:
ssh2_transport_read()
The function fails to properly validate the incoming:
packet_length
field before allocating and processing packet data.
A remote attacker can send a specially crafted SSH packet containing an oversized length value, causing:
Because the vulnerability is triggered during SSH transport packet processing, exploitation may occur before authentication, significantly increasing the severity of the issue.
Simplified vulnerable flow:
packet_length = read_packet_length();
buffer = malloc(packet_length);
memcpy(buffer, incoming_data, packet_length);
If packet_length is attacker-controlled and exceeds expected boundaries:
Attacker
│
▼
Crafted SSH Packet
│
▼
Oversized packet_length
│
▼
Heap Corruption
│
┌──┴──┐
▼ ▼
DoS Potential RCE
| Component | Affected Versions |
|---|---|
| libssh2 | <= 1.11.1 |
Any application embedding libssh2 may be vulnerable, including:
Note: OpenSSH itself does not use libssh2 and is not directly affected.
| Requirement | Value |
|---|---|
| Network Access | Required |
| Authentication | Not Required |
| User Interaction | Not Required |
| Attack Complexity | Low |
| Remote Attack | Yes |
Security teams should monitor for:
ssh2_transport_read()pkg-config --modversion libssh2
dpkg -l | grep libssh2
apt-cache policy libssh2-1
rpm -qa | grep libssh2
dnf info libssh2
apk info | grep libssh2
ldconfig -p | grep libssh2
find /usr -type f -executable -exec ldd {} \; 2>/dev/null | grep libssh2
Upgrade to a version containing:
97acf3dfda80c91c3a8c9f2372546301d4a1a7a8
sudo apt update
sudo apt upgrade libssh2-1
sudo reboot
sudo dnf update libssh2
sudo reboot
sudo dnf upgrade --refresh libssh2
sudo reboot
apk update
apk upgrade libssh2
Until patches are available:
sudo ufw allow from TRUSTED_IP to any port 22
sudo ufw deny 22
iptables -A INPUT -p tcp --dport 22 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="TRUSTED_IP" port protocol="tcp" port="22" accept'
firewall-cmd --reload
Compile applications with:
-fstack-protector-strong
-D_FORTIFY_SOURCE=2
-fPIE
-pie
-Wl,-z,relro,-z,now
Enable:
✓ ASLR
✓ Stack Canaries
✓ RELRO
✓ NX
✓ PIE
✓ Latest Security Patches
For untrusted workloads:
docker run \
--read-only \
--cap-drop=ALL \
--security-opt no-new-privileges
Additional recommendations:
Deploy:
| Category | Rating |
|---|---|
| Exploitability | High |
| Complexity | Low |
| Authentication | None |
| Remote Attack | Yes |
| Supply Chain Risk | High |
| Internet Exposure | High |
| Date | Event |
|---|---|
| June 2026 | Vulnerability publicly disclosed |
| June 2026 | Security advisory released |
| June 2026 | Fix commit published |
| June 2026+ | Vendor patches begin shipping |
| Resource | Link |
|---|---|
| NVD | https://nvd.nist.gov/vuln/detail/CVE-2026-55200 |
| libssh2 Project | https://libssh2.org |
| GitHub Repository | https://github.com/libssh2/libssh2 |
| Fix Commit | https://github.com/libssh2/libssh2/commit/97acf3dfda80c91c3a8c9f2372546301d4a1a7a8 |
No. OpenSSH does not use libssh2 internally.