Public PoC Released for Critical libssh2 CVE-2026-55200 Client-Side SSH Flaw
Summary: A public proof-of-concept is now available for CVE-2026-55200, a critical libssh2 flaw that lets a malicious or compromised SSH server trigger an out-of-bounds heap write on a connecting client with no credentials or user interaction, affecting every release through 1.11.1 at CVSS 4.0 score 9.2. The bug lives in ssh2_transport_read() in transport.c, which rejected packet_length values below 1 but never enforced an upper bound, so a length of 0xffffffff wraps in 32-bit arithmetic and allocates a tiny buffer that later receives the full oversized packet; researcher Tristan Madani reported it, maintainers merged the fix via pull request #2052 on June 12, VulnCheck published the CVE on June 17, and no fixed release is tagged yet.
Bottom line: libssh2 is statically linked into curl, Git, PHP, backup agents, firmware updaters and appliances, so a distro package update will not touch those copies and you may not know they are there - and this is the same integer-overflow class as CVE-2019-3855, fixed in 2019 and back in the same code seven years later.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2019-3855CVE-2025-15661CVE-2026-55199CVE-2026-55200
- Related
- ⚡ Weekly Recap: Linux Kernel Flaws, AI Malware Tricks, Turla Backdoor, Infostealers and More Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026