xd20111/cve-2026-55200Detailed analysis of a critical pre-authentication out-of-bounds write vulnerability in libssh2 leading to remote code execution, with root cause, detection, and mitigation guidance.
| Field | Detail |
|---|
| CVE | CVE-2026-55200 |
| CVSS | 9.2 Critical |
| Type | Out-of-Bounds Write |
| Component | libssh2 |
| Affected Versions | <= 1.11.1 |
| Attack Vector | Network |
| Privileges Required | None |
| User Interaction | None |
| Impact | Remote Code Execution (RCE), Denial of Service (DoS) |
| Fixed In | Commit 97acf3dfda80c91c3a8c9f2372546301d4a1a7a8 |
| Disclosure Date | June 2026 |
CVE-2026-55200 is a critical memory corruption vulnerability affecting the widely deployed libssh2 library.
The flaw exists in the SSH transport layer packet processing logic inside:
ssh2_transport_read()
The function fails to properly validate the incoming:
packet_length
field before allocating and processing packet data.
A remote attacker can send a specially crafted SSH packet containing an oversized length value, causing:
Because the vulnerability is triggered during SSH transport packet processing, exploitation may occur before authentication, significantly increasing the severity of the issue.
Simplified vulnerable flow:
packet_length = read_packet_length();
buffer = malloc(packet_length);
memcpy(buffer, incoming_data, packet_length);
If packet_length is attacker-controlled and exceeds expected boundaries:
Attacker
│
▼
Crafted SSH Packet
│
▼
Oversized packet_length
│
▼
Heap Corruption
│
┌──┴──┐
▼ ▼
DoS Potential RCE
| Component | Affected Versions |
|---|---|
| libssh2 | <= 1.11.1 |
Any application embedding libssh2 may be vulnerable, including:
Note: OpenSSH itself does not use libssh2 and is not directly affected.
| Requirement | Value |
|---|---|
| Network Access | Required |
| Authentication | Not Required |
| User Interaction | Not Required |
| Attack Complexity | Low |
| Remote Attack | Yes |
Security teams should monitor for:
ssh2_transport_read()pkg-config --modversion libssh2
dpkg -l | grep libssh2
apt-cache policy libssh2-1
rpm -qa | grep libssh2
dnf info libssh2
apk info | grep libssh2
ldconfig -p | grep libssh2
find /usr -type f -executable -exec ldd {} \; 2>/dev/null | grep libssh2
Upgrade to a version containing:
97acf3dfda80c91c3a8c9f2372546301d4a1a7a8
sudo apt update
sudo apt upgrade libssh2-1
sudo reboot
sudo dnf update libssh2
sudo reboot
sudo dnf upgrade --refresh libssh2
sudo reboot
apk update
apk upgrade libssh2
Until patches are available:
sudo ufw allow from TRUSTED_IP to any port 22
sudo ufw deny 22
iptables -A INPUT -p tcp --dport 22 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="TRUSTED_IP" port protocol="tcp" port="22" accept'
firewall-cmd --reload
Compile applications with:
-fstack-protector-strong
-D_FORTIFY_SOURCE=2
-fPIE
-pie
-Wl,-z,relro,-z,now
Enable:
✓ ASLR
✓ Stack Canaries
✓ RELRO
✓ NX
✓ PIE
✓ Latest Security Patches
For untrusted workloads:
docker run \
--read-only \
--cap-drop=ALL \
--security-opt no-new-privileges
Additional recommendations:
Deploy:
| Category | Rating |
|---|---|
| Exploitability | High |
| Complexity | Low |
| Authentication | None |
| Remote Attack | Yes |
| Supply Chain Risk | High |
| Internet Exposure | High |
| Date | Event |
|---|---|
| June 2026 | Vulnerability publicly disclosed |
| June 2026 | Security advisory released |
| June 2026 | Fix commit published |
| June 2026+ | Vendor patches begin shipping |
| Resource | Link |
|---|---|
| NVD | https://nvd.nist.gov/vuln/detail/CVE-2026-55200 |
| libssh2 Project | https://libssh2.org |
| GitHub Repository | https://github.com/libssh2/libssh2 |
| Fix Commit | https://github.com/libssh2/libssh2/commit/97acf3dfda80c91c3a8c9f2372546301d4a1a7a8 |
No. OpenSSH does not use libssh2 internally.
Yes. The vulnerability can potentially be triggered before authentication.
Successful exploitation depends on:
However, memory corruption vulnerabilities of this class are historically considered highly dangerous.
At the time of publication, there are no publicly confirmed reports of active exploitation.
This repository is intended for educational and defensive security purposes only.
Do not use any information or code from this repository on systems you do not own or have explicit written authorization to test.
Patch Early • Audit Dependencies • Secure Your Supply Chain 🛡️
Cybersecurity • Vulnerability Research • Threat Intelligence