← Vulnerability feed

Vulnerability record · CVE-2026-55200 · published 17 June 2026

CVE-2026-55200: Libssh2 vulnerability

LLibssh2 · Libssh2

libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.

9.2 CVSS 4.0 Critical EPSS 0.83% · top 44.3% CWE-680 · CWE-680
9.2CVSS 4.0 base score
0.83%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 1 tagged exploit
17 Sep 2026Last modified by NVD

Description

libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/libssh2/libssh2/commit/97acf3dfda80c91c3a8c9f2372546301d4a1a7a8 Patch
https://github.com/libssh2/libssh2/pull/2052 Patch
https://www.vulncheck.com/advisories/libssh2-out-of-bounds-write-via-unchecked-packet-length-in-transport-c Third Party Advisory
https://web.archive.org/web/20260623211210/https://github.com/bikini/exploitarium/tree/main/libssh2-cve-2026-55200-poc ExploitThird Party Advisory

Track CVE-2026-55200 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.1CVE-2019-3860Libssh2 out-of-bounds read vulnerabilityAn out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed. A remote attacker who compr…EPSS 5.1%9.1CVE-2019-3861Libssh2 out-of-bounds read vulnerabilityAn out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packet length a…EPSS 5.1%9.1CVE-2019-3858Libssh2 out-of-bounds read vulnerabilityAn out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from the server. A remote attacker…EPSS 6.4%9.1CVE-2019-3859Libssh2 out-of-bounds read vulnerabilityAn out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_requirev functions. A remote att…EPSS 6.3%9.1CVE-2019-3862Libssh2 out-of-bounds read vulnerabilityAn out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no paylo…EPSS 8.1%8.8CVE-2019-3856Libssh2 integer overflow vulnerabilityAn integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requests are …EPSS 6.1%8.8CVE-2019-3857Libssh2 integer overflow vulnerabilityAn integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets…EPSS 6.1%8.8CVE-2019-3863Libssh2 integer overflow vulnerabilityA flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. A server could send a multiple keyboard interactive respons…EPSS 3.4%

Source: NIST National Vulnerability Database (record CVE-2026-55200), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.