CVE-2026-55200: libssh2 Integer Overflow to Heap Out-of-Bounds Write in ssh2_transport_read()
CVE-2026-55200 (TL-2026-0931), also tracked as GHSA-r8mh-x5qv-7gg2, is a critical-severity software vulnerability scored CVSS 9.2, first published 2026-06-24. It has no confirmed attribution, affects libssh2 project libssh2, references 1 CVE (CVE-2026-55200), maps to 16 MITRE ATT&CK techniques (T1059, T1071, T1133), and is covered by 9 detection rules and 20 indicators of compromise.
Key facts for TL-2026-0931
- Threat ID
- TL-2026-0931
- Also known as
- GHSA-r8mh-x5qv-7gg2
- Severity
- CRITICAL
- CVSS
- 9.2 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-06-24
- Last reviewed
- 2026-06-24
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- technology, telecommunications, manufacturing, energy, financial, government, embedded-iot
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 20
An integer-overflow-to-heap-buffer-overflow flaw (CWE-680) in libssh2's ssh2_transport_read() fails to enforce upper bounds on the SSH packet_length field, letting a malicious or MITM SSH peer trigger a pre-authentication out-of-bounds heap write that can lead to remote code execution or denial of service. All versions through libssh2 1.11.1 are affected; the fix was merged in commit 97acf3df (PR #2052).
How CVE-2026-55200 works
CVE-2026-55200 is a critical (CVSS v4.0 9.2 / CVSS v3.1 8.1) memory-corruption vulnerability in libssh2, a widely embedded C library that implements the client side of the SSH-2 protocol and is bundled by curl/libcurl, backup utilities, network-management tooling, and a large number of IoT, router, NAS, and industrial-controller firmware images.
The defect lives in ssh2_transport_read() in transport.c. When libssh2 reads an incoming SSH binary packet it parses the 4-byte big-endian packet_length field but does not validate it against an internal maximum (LIBSSH2_PACKET_MAXPAYLOAD) before using it in allocation arithmetic. An attacker who controls the remote SSH endpoint (a malicious server that a libssh2 client connects to, or an on-path man-in-the-middle) can set packet_length to a very large value such as 0xffffffff. In the vulnerable allocation path the computed total (conceptually total_num = 4 + packet_length + mac_len + auth_len) wraps modulo 2^32 — for example 0xffffffff + 0 + 16 wraps to 15, so libssh2 allocates a tiny heap buffer (≈19 bytes) instead of the intended large region. Subsequent packet processing still references the original oversized packet_length and copies far more data than the undersized buffer can hold, producing an out-of-bounds heap write that corrupts adjacent heap structures.
Because the bug is reached during the SSH transport/key-exchange phase, exploitation occurs PRE-AUTHENTICATION with no credentials and no user interaction. The consequences range from a reliable denial of service (process crash) to potential remote code execution, depending on heap layout and platform; the upstream project addressed both a code-execution path (commit 97acf3df) and a related denial-of-service path (commit 1762685). A separate companion issue, CVE-2026-55199, was fixed in the same area.
The vulnerability was responsibly disclosed by security researcher Tristan Madani (@TristanInSec); the fix was implemented by contributor willco007 in PR #2052 and adds strict bounds checking that rejects packets whose packet_length exceeds the maximum allowed payload (returning LIBSSH2_ERROR_OUT_OF_BOUNDARY). At disclosure there was no confirmed in-the-wild exploitation and EPSS was low (~0.6% 30-day), but proof-of-concept components demonstrating the integer wrap and a controlled heap-exploitation harness were published, and the no-auth network vector makes this a high-priority patch for any product that statically links or bundles libssh2.
MITRE ATT&CK techniques used in TL-2026-0931
Execution
T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution
Command and Control
T1071 Application Layer Protocol; T1573 Encrypted Channel
Initial Access
T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1199 Trusted Relationship
Lateral Movement
T1210 Exploitation of Remote Services
Defense Evasion
T1211 Exploitation for Stealth
Credential Access
T1212 Exploitation for Credential Access
Impact
T1499 Endpoint Denial of Service
Collection
Resource Development
T1583 Acquire Infrastructure; T1587 Develop Capabilities; T1588 Obtain Capabilities; T1608 Stage Capabilities
Affected products and versions in CVE-2026-55200
- libssh2 project — libssh2
Vulnerable versions: 0 through 1.11.1
Fixed in: commit 97acf3df (PR #2052); Debian 1.11.1-3 - curl project — curl / libcurl (with libssh2 SCP/SFTP backend)
Vulnerable versions: builds linking libssh2 <= 1.11.1
Fixed in: rebuild against patched libssh2
Remediation for CVE-2026-55200
Patches
- libssh2 fix commit 97acf3dfda80c91c3a8c9f2372546301d4a1a7a8 (merge of PR #2052)
- libssh2 DoS-path fix commit 1762685
- Distribution rebuilds bundling the patched libssh2 (e.g., Debian 1.11.1-3)
Immediate actions
- Inventory all software that statically links or bundles libssh2 (use ldd, strings, or SBOM tooling) and prioritize internet-facing and embedded systems.
- Update libssh2 to a build containing fix commits 97acf3df (RCE) and 1762685 (DoS); on Debian, the patched build is tracked as 1.11.1-3.
- Restrict and monitor outbound SSH/SCP/SFTP connections from libssh2-based clients to untrusted servers, since the bug triggers when connecting to attacker-controlled endpoints.
Workarounds
- Avoid initiating libssh2-based SSH/SCP/SFTP sessions to untrusted or unverified servers until patched.
- Apply network segmentation and egress filtering around hosts and devices that cannot be immediately updated.
- Where possible, route SSH through a hardened, patched jump host or proxy.
Longer-term hardening
- Maintain an SBOM and continuously track third-party library CVEs for transitively bundled components like libssh2.
- Deploy network monitoring/IDS rules that flag anomalously large SSH packet_length values during key exchange.
- Adopt memory-safety hardening (ASLR, heap hardening, compiler mitigations) for services that parse untrusted network input.
CVEs associated with CVE-2026-55200
Weaknesses (CWE) in CVE-2026-55200
CWE-680, CWE-787, CWE-190
Timeline of CVE-2026-55200
- Contributor willco007 pushes and merges PR #2052 to libssh2 master adding bounds checking on packet_length; fix commits include 0c76580b, 943e45c7 and merge 97acf3df (credit to researcher Tristan Madani).
- Upstream feature branch for PR #2052 deleted after merge.
- Cyber Security News publishes the first public write-up describing the unchecked packet_length out-of-bounds heap write in ssh2_transport_read().
- CVE-2026-55200 publicly disclosed (CVSS v4.0 9.2 / v3.1 8.1, CWE-680); GitHub Advisory GHSA-r8mh-x5qv-7gg2 and VulnCheck advisory published; reported by Tristan Madani (@TristanInSec).
- Additional outlets (Cyber Kendra, GBHackers, CyberPress) report the zero-auth RCE affecting all libssh2 versions through 1.11.1.
- NVD record for CVE-2026-55200 last modified, confirming CVSS scoring and reference set.
- The CyberSec Guru publishes follow-up analysis framing CVE-2026-55200 as a critical libssh2 RCE flaw affecting all versions and urging downstream consumers (curl/libcurl, automation frameworks, file-transfer tools) to rebuild against the patched library.
- Detailed technical analysis published describing the integer-wrap arithmetic (0xffffffff+0+16 -> 15) and four PoC components (C11 arithmetic verifier, Python SSH trigger, C heap-exploitation harness, Python exploit driver).
- Distribution maintainers ship rebuilt packages bundling the patched libssh2 (e.g., Debian tracks the fixed build as 1.11.1-3); defenders advised to inventory SBOMs and prioritize patching internet-facing and embedded systems.
Sources cited for CVE-2026-55200
- NVD - CVE-2026-55200
- GitHub Advisory Database - GHSA-r8mh-x5qv-7gg2
- libssh2 fix commit 97acf3dfda80c91c3a8c9f2372546301d4a1a7a8
- libssh2 PR #2052 - Add additional bounds checking on packet length
- VulnCheck Advisory - libssh2 out-of-bounds write via unchecked packet length in transport.c
- Cyber Security News - libssh2 Vulnerability Lets Attackers Trigger Out-of-Bounds Heap Write (CVE-2026-55200)
- The CyberSec Guru - CVE-2026-55200: Critical libssh2 RCE Flaw Affects All Versions
- Cyber Kendra - CVE-2026-55200 Critical libssh2 Flaw Enables Zero-Auth RCE
Threats related to CVE-2026-55200
Detection coverage for TL-2026-0931
As of 2026-06-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0931 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.