Security: CVE-2026-55200 - libssh2 memory corruption (CVSS 9.2, no fix release yet)

[muhamedfazalps]

Vulnerability: CVE-2026-55200 (CVSS 9.2) - libssh2 integer overflow to heap buffer overflow in ssh2_transport_read()

Affected: libssh2 <= 1.11.1 (all current releases)

Impact: A malicious SSH server can trigger memory corruption on a connecting client, leading to potential code execution. No credentials or user interaction required.

Details:

• The flaw is in transport.c - packet_length field lacks upper bound check
• 32-bit integer overflow allows tiny allocation followed by oversized write
• Public PoC released: transport.c: Additional boundary checks for packet length libssh2/libssh2#2052
• Fix merged to mainline but no tagged release yet (latest tag is 1.11.1 = vulnerable)

Recommendation:

• Monitor https://github.com/libssh2/libssh2 for new release
• Consider backporting commit 97acf3d to your bundled libssh2
• Debian already has a patched build in testing

References:

• transport.c: Additional boundary checks for packet length libssh2/libssh2#2052
• https://thehackernews.com/2026/06/public-poc-released-for-critical.html
• NHS England advisory issued

---

Discovered during security research. Hope this helps! https://buymeacoffee.com/muhamedfazalps

[pkittenis]

Thank you for the interest and report.

Awaiting a new release of libssh2 to resolve.