Public PoC Released for Critical libssh2 Client-Side SSH Flaw (CVE-2026-55200)

Public PoC Released for Critical libssh2 Client-Side SSH (TL-2026-1226), also tracked as libssh2 packet_length integer overflow, is a critical-severity software vulnerability scored CVSS 9.2, first published 2026-07-11 and last reviewed 2026-08-04. It has no confirmed attribution, affects libssh2 libssh2, references 3 CVEs (CVE-2026-55200, CVE-2026-55199, CVE-2025-15661), maps to 17 MITRE ATT&CK techniques (T1027, T1068, T1071), and is covered by 9 detection rules and 17 indicators of compromise.

Key facts for TL-2026-1226

Threat ID
TL-2026-1226
Also known as
libssh2 packet_length integer overflow, libssh2 ssh2_transport_read heap overflow
Severity
CRITICAL
CVSS
9.2 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-11
Last reviewed
2026-08-04
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
technology, software-development, cloud-infrastructure, managed-service-providers, critical-infrastructure, manufacturing
Target regions
Global
Detection rules
9
Indicators of compromise
17
Updates
2026-08-04 · revalidated 1× · latest source

A critical integer-overflow-to-buffer-overflow vulnerability in libssh2's ssh2_transport_read() (all releases through 1.11.1) lets a malicious or compromised SSH server send an oversized, attacker-controlled packet_length field to corrupt client heap memory pre-authentication, with potential remote code execution. A public proof-of-concept (local trigger/harness, not a turnkey remote exploit) was published in the 'exploitarium' GitHub archive on 2026-06-29; no in-the-wild exploitation has been confirmed and CISA lists no exploitation rating.

How Public PoC Released for Critical libssh2 Client-Side SSH works

CVE-2026-55200 is a critical (CVSS 9.2) out-of-bounds write vulnerability in libssh2, the widely embedded C SSH client library used by curl, Git GUI clients, PHP's SFTP functionality, backup/automation agents, firmware updaters, and countless IoT/embedded appliances. The flaw lives in ssh2_transport_read() in src/transport.c, the function responsible for parsing incoming SSH packets during the transport-layer handshake, before any cryptographic authentication of the server has occurred.

The root cause is a missing upper-bound check on the SSH packet_length field. RFC 4253 caps this field at 35,000 bytes, but libssh2's parser only rejected values below 1 -- it never validated the upper bound before using packet_length in an arithmetic buffer-size calculation. A malicious server can send packet_length = 0xFFFFFFFF. When combined with mac_len and auth_len in the allocation-size computation, 32-bit integer wraparound occurs (e.g. 0xFFFFFFFF + 0 + 16 wraps to 15, then +4 == 19), causing libssh2 to allocate a tiny buffer (as little as 19 bytes) while subsequent packet-processing code still operates against the original, enormous packet_length value. The result is a linear heap buffer overflow with attacker-influenced write length, corrupting adjacent heap memory and creating a path to remote code execution on the connecting client.

Because the trigger occurs during transport-layer parsing, exploitation requires no credentials and no user interaction -- only that the client initiate an SSH/SFTP connection to a server the attacker controls or has compromised (e.g. via DNS hijack, BGP hijack, MITM, or a trojanized/malicious update/mirror server). This makes automated tooling -- CI/CD SSH deploy steps, backup agents, firmware updaters, and any outbound SSH automation reaching untrusted or attacker-influenced hosts -- a particularly attractive target class, inverting the usual SSH threat model (client-side rather than server-side compromise).

The defect is a near-exact structural recurrence of CVE-2019-3855, an integer overflow at the same code location in libssh2 1.8.1 patched seven years earlier, underscoring a recurring pattern of insufficiently defensive length-field handling in libssh2's packet parser.

Maintainers merged the fix via pull request #2052 on 2026-06-12, landing in commit 97acf3dfda80c91c3a8c9f2372546301d4a1a7a8, which adds validation rejecting packet_length values exceeding LIBSSH2_PACKET_MAXPAYLOAD before any arithmetic is performed. VulnCheck published the CVE on 2026-06-17 (reported by researcher Tristan Madani). On 2026-06-29, a public PoC was published in the 'exploitarium' GitHub archive under path libssh2-cve-2026-55200-poc, authored by GitHub user 'bikini'. The PoC repository includes: cve_2026_55200_probe.c (a standalone C11 arithmetic verifier demonstrating the 32-bit wraparound), libpwn_cve_2026_55200_server.py (a malicious SSH server implementing an encrypted trigger over curve25519-sha256 key exchange and chacha20-poly1305 cipher to reach the vulnerable code path realistically), libpwn_local_rce_harness.c (a controlled vulnerable target modeling the allocation-to-overflow pattern), and libpwn_local_rce_exploit.py (a local exploit driver demonstrating RCE against the harness). The repository explicitly restricts use to local research targets, owned systems, or authorized lab/CTF/HTB instances, and the PoC as published is a verified local trigger/harness rather than a reliable, turnkey remote exploit -- real-world reliability against a live target still depends on the embedding application's build, allocator behavior, ASLR/hardening, and how libssh2 is linked.

CVE-2026-55200 was published alongside two related libssh2 flaws disclosed in the same research/patch cycle: CVE-2026-55199 (CVSS 8.2), a pre-authentication denial-of-service in the SSH_MSG_EXT_INFO handler (src/packet.c) where an attacker-controlled nr_extensions field can be set to 0xFFFFFFFF, driving the client into a ~4-billion-iteration parsing loop that pins CPU for 60+ seconds (fixed in commit 1762685); and CVE-2025-15661 (CVSS 8.3), an SFTP heap over-read. Multiple downstream vulnerability trackers additionally reference CVE-2026-7598 (integer overflow RCE), CVE-2026-58050 (buffer overflow), and CVE-2026-58051 (use-after-free) as part of the broader libssh2 hardening cycle in this period.

CVSS scoring varies materially by methodology: NIST's CVSS v3.1 base score is 8.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L), VulnCheck's CVSS v3.1 assessment is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), while the CVSS v4.0 score used for hunt prioritization is 9.2 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). CISA's Known Exploited Vulnerabilities catalog does not list CVE-2026-55200 as of this writing, and CISA's exploitation-observed rating remains 'none' -- there is no confirmed in-the-wild exploitation, only public PoC availability. EPSS scores the CVE at approximately 0.73% (50th percentile), reflecting that despite the severity, near-term mass exploitation is not currently predicted, though the combination of critical severity, pre-auth trigger, zero user interaction, and public PoC materially elevates weaponization risk. As libssh2 is frequently statically linked, patched builds of the library alone are insufficient -- every downstream application and appliance embedding libssh2 must be individually identified, rebuilt, and redeployed, a remediation burden the advisories flag as the primary operational risk of this disclosure.

MITRE ATT&CK techniques used in TL-2026-1226

Defense Evasion

T1027 Obfuscated Files or Information; T1211 Exploitation for Stealth

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071 Application Layer Protocol; T1571 Non-Standard Port; T1573 Encrypted Channel

Initial Access

T1189 Drive-by Compromise; T1190 Exploit Public-Facing Application

Execution

T1203 Exploitation for Client Execution

Impact

T1489 Service Stop; T1499 Endpoint Denial of Service

Persistence

T1554 Compromise Host Software Binary

Collection

T1557 Adversary-in-the-Middle

Resource Development

T1585 Establish Accounts; T1587 Develop Capabilities; T1588 Obtain Capabilities

Reconnaissance

T1595 Active Scanning

Affected products and versions in Public PoC Released for Critical libssh2 Client-Side SSH

  • libssh2 — libssh2
    Vulnerable versions: 0 through 1.11.1; all releases up to and including 1.11.1
    Fixed in: commit 97acf3dfda80c91c3a8c9f2372546301d4a1a7a8 (post-1.11.1)
  • curl — curl (statically linked with libssh2)
    Vulnerable versions: builds linking libssh2 <= 1.11.1
    Fixed in: builds relinked against patched libssh2
  • PHP — PHP SFTP/SSH2 extensions using libssh2
    Vulnerable versions: extensions bundling/linking libssh2 <= 1.11.1
    Fixed in: rebuilt against patched libssh2
  • Git — Git GUI clients using libssh2 transport
    Vulnerable versions: clients bundling libssh2 <= 1.11.1
    Fixed in: clients bundling patched libssh2

Remediation for Public PoC Released for Critical libssh2 Client-Side SSH

Patches

  • libssh2 commit 97acf3dfda80c91c3a8c9f2372546301d4a1a7a8 (fixes CVE-2026-55200, PR #2052, merged 2026-06-12)
  • libssh2 commit 1762685 (fixes companion CVE-2026-55199 pre-auth DoS)

Immediate actions

  • Inventory all systems, applications, and appliances that dynamically or statically link libssh2 (curl builds, Git GUI clients, PHP SFTP extensions, backup agents, firmware updaters, embedded/IoT devices)
  • Upgrade libssh2 to a build containing commit 97acf3dfda80c91c3a8c9f2372546301d4a1a7a8 (merged via PR #2052) or a vendor/distro backport
  • Restrict outbound SSH client connectivity to an allowlist of trusted, verified hosts at the network perimeter
  • Enforce strict SSH host key verification / known_hosts pinning in all libssh2-based client tooling to reduce MITM/rogue-server exposure

Workarounds

  • Disable or pause SSH-based CI/CD automation and backup jobs that reach unverified or third-party hosts until patched
  • Block egress SSH connections to any server outside a pinned, trusted host-key allowlist
  • Monitor for application crashes or anomalous memory faults occurring during the SSH transport/key-exchange handshake phase

Longer-term hardening

  • Rebuild and redeploy every application with statically linked libssh2 rather than relying on shared-library patching alone
  • Deploy network signatures/IDS rules detecting SSH packets with packet_length or extension-count fields exceeding RFC 4253's 35,000-byte cap
  • Harden CI/CD, backup, and firmware-update pipelines that perform outbound SSH so they cannot reach attacker-influenced or unverified endpoints
  • Enable OS-level exploit mitigations (ASLR, hardened heap allocators, SELinux/AppArmor) on hosts running libssh2-linked automation

CVEs associated with Public PoC Released for Critical libssh2 Client-Side SSH

CVE-2026-55200, CVE-2026-55199, CVE-2025-15661

Weaknesses (CWE) in Public PoC Released for Critical libssh2 Client-Side SSH

CWE-680, CWE-190, CWE-787, CWE-835

Timeline of Public PoC Released for Critical libssh2 Client-Side SSH

  • CVE-2019-3855, a nearly identical integer overflow at the same code location in libssh2 1.8.1, is patched -- establishing the recurring pattern that CVE-2026-55200 later re-exposes.
  • Companion fix for CVE-2026-55199 further identified as libssh2 PR #1864 (full commit 17626857d20b3c9a1addfa45979dadcee1cd84a4), adding return-value checks and capping nr_extensions at 1024 in src/packet.c.
  • libssh2 maintainers merge pull request #2052, landing commit 97acf3dfda80c91c3a8c9f2372546301d4a1a7a8, adding upper-bound validation for packet_length in ssh2_transport_read().
  • VulnCheck publishes CVE-2026-55200, reported by researcher Tristan Madani, with a CVSS v4.0 score of 9.2 (Critical).
  • The Hacker News publishes coverage of the public PoC release, driving broader security-community awareness.
  • A public proof-of-concept -- a local trigger/harness rather than a turnkey remote exploit -- is published in the 'exploitarium' GitHub archive by user 'bikini', including an arithmetic verifier, a malicious SSH server implementation, and a local RCE exploit driver.
  • Arctic Wolf and other security vendors publish mitigation guidance urging inventory of libssh2-linked applications and urgent patching.
  • NVD record for CVE-2026-55200 is last modified, reflecting CVSS v3.1 and v4.0 scoring, CWE-680 classification, and CPE affected-product data.
  • As of this analysis, CISA lists no exploitation-observed rating for CVE-2026-55200 and it does not appear in the CISA KEV catalog; no in-the-wild exploitation has been confirmed.
  • Follow-up report reconfirms CVE-2026-55200 remains absent from the CISA KEV catalog with no confirmed in-the-wild exploitation; libgit2 (pygit2/nodegit/Rugged bindings) documented as an additional libssh2-linked downstream consumer.

Update history for TL-2026-1226

Sources cited for Public PoC Released for Critical libssh2 Client-Side SSH

Threats related to Public PoC Released for Critical libssh2 Client-Side SSH

Detection coverage for TL-2026-1226

As of 2026-08-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1226 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats