CVE-2026-55200

This flaw is in libssh2, a library commonly used by programs to handle SSH connections. An attacker can send a specially malformed SSH message with an invalid “packet length,” which can trick the software into writing beyond where it should in memory—leading to crashes or, in the worst case, letting the attacker run code. Think of it like a network message that lies about how big the payload is, causing the receiver to write into the wrong memory space.

This matters if you run software that uses libssh2 to make SSH connections (for example, tools that pull files over SSH or remote management components built on libssh2). Because the vulnerability can be triggered remotely and does not require authentication, it’s most relevant when your client connects to SSH servers you don’t fully control.
Reachability gate: only a risk if the vulnerable libssh2 SSH client read path is reachable from the network you allow (in practice, if your software connects to attacker-controlled or untrusted SSH endpoints).

This is AMBER because it is a high-impact memory corruption flaw in a widely used SSH library, meaning a network attacker could potentially achieve code execution. Even though there’s no confirmed in-the-wild exploitation report, a public proof-of-concept exists, and the vendor has provided a fix—so you should prioritize upgrading.

1. Confirm exposure in your environment

   • Identify where libssh2 is used: check your application dependencies, OS packages, container images, and any statically linked binaries.
   • Record the exact libssh2 version you are running (including transitive dependency versions).

2. Determine if you’re affected

   • The affected scope is “all versions of libssh2 up to and including 1.11.1.” If your version is 1.11.1 or earlier, you are in scope.

3. Upgrade to the fixed version

   • The fix is available at commit 7acf3dfda80c91c3a8c9f2372546301d4a1a7a8.
   • Follow your normal update process for your environment (package manager update, rebuilding from source, or updating the component/vendor that bundles libssh2).
   • If your software pins a libssh2 version, update that pin to the fixed build.

4. Temporary workaround if patching is delayed

   • Restrict outbound SSH traffic from the affected hosts so they can only reach trusted SSH servers.
   • If your workflows allow it, disable or avoid connections to unknown/untrusted SSH endpoints until the upgrade is applied.

5. What to monitor

   • Watch for unexpected crashes/restarts of the process that uses libssh2.
   • Review network logs for unusual SSH connection patterns to your client systems (especially repeated connections from new or suspicious sources).

6. CISA due date

   • Not listed in CISA KEV per the provided findings, so no KEV-specific due date is available here.

Severity is high (CVSS 8.1) with memory corruption impact. The weakness is CWE-680 (Uncontrolled/Unchecked manipulation of data leading to out-of-bounds write): libssh2 fails to enforce an upper bound on the SSH packet_length field when reading transport packets in ssh2_transport_read().
Attack vector is network: a remote party can send crafted SSH packets that claim abnormally large packet lengths, leading to heap memory corruption. The provided findings indicate no authentication or user interaction is required to trigger the issue.
Exploitation status: no confirmed exploitation report is listed, but a public proof-of-concept exists that can be used by a malicious or compromised SSH server to trigger memory corruption on a connecting client; no public exploit code is recorded. KEV is not listed. Patch availability is confirmed: fixed at commit 7acf3dfda80c91c3a8c9f2372546301d4a1a7a8.