Report feedback

An unauthenticated remote attacker with a malicious SSH server or in a MitM position can exploit an out-of-bounds write when processing incoming transport traffic, and by sending specially crafted SSH packets with an excessively large packet length value, heap memory corruption and RCE may occur [13]. A public PoC is available [14], and to temporarily mitigate this vulnerability, outgoing SSH communication can be restricted to verified servers only, clients accessing external targets can be secured as a priority, and unusual network traffic can be monitored [15]. A commit with the patch is available at [16].

The vulnerability is present in product:

• libssh2; <= 1.11.1;

CVSS: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

More information:

• CVE-2026-55200 at cve.org, NVD
• CWE-680: Integer Overflow to Buffer Overflow at cwe.mitre.org

The vulnerability was publicly disclosed 17. 6. 2026.

An unauthenticated remote attacker with a malicious SSH server or in a MitM position can exploit a heap out-of-bounds read when processing symbolic links (symlinks) within the SFTP protocol, and by sending specially crafted SFTP responses with a spoofed (excessively large) link length parameter, the attacker can disclose heap memory contents or cause DoS [17]. A commit with the patch is available at [18].

The vulnerability is present in product:

• libssh2; <= 1.11.1;

CVSS: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

More information:

• CVE-2025-15661 at cve.org, NVD
• CWE-125: Out-of-bounds Read at cwe.mitre.org

The vulnerability was publicly disclosed 18. 6. 2026.

An unauthenticated remote attacker with a malicious SSH server can abuse the processing of SSH extension information and, by sending a specially crafted (excessively high) value for the number of these extensions, cause an endless loop and exhaustion of CPU resources on the client side, leading to DoS even before the authentication phase [19]. A commit with the patch is available at [20].

The vulnerability is present in product:

• libssh2; <= 1.11.1;

CVSS: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

More information:

• CVE-2026-55199 at cve.org, NVD
• CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') at cwe.mitre.org

The vulnerability was publicly disclosed 17. 6. 2026.

An unauthenticated remote attacker with a malicious SSH server can, on 32-bit platforms, exploit a vulnerability in the public key subsystem and, by sending a specially crafted attribute count value without bounds checking, cause an integer overflow when calculating the memory allocation, resulting in a heap overflow that may lead to DoS or potential ACE [21][22].

The vulnerability is present in product:

• libssh2; <= 1.11.1;

CVSS: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

More information:

• CVE-2026-58050 at cve.org, NVD
• CWE-190: Integer Overflow or Wraparound at cwe.mitre.org

The vulnerability was publicly disclosed 27. 6. 2026.