Public PoC Released for Critical libssh2 Client-Side SSH Flaw (CVE-2026-55200)
Public PoC Released for Critical libssh2 Client-Side SSH (TL-2026-1226), also tracked as libssh2 packet_length integer overflow, is a critical-severity software vulnerability scored CVSS 9.2, first published 2026-07-11 and last reviewed 2026-08-04. It has no confirmed attribution, affects libssh2 libssh2, references 3 CVEs (CVE-2026-55200, CVE-2026-55199, CVE-2025-15661), maps to 17 MITRE ATT&CK techniques (T1027, T1068, T1071), and is covered by 9 detection rules and 17 indicators of compromise.
Key facts for TL-2026-1226
- Threat ID
- TL-2026-1226
- Also known as
- libssh2 packet_length integer overflow, libssh2 ssh2_transport_read heap overflow
- Severity
- CRITICAL
- CVSS
- 9.2 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-07-11
- Last reviewed
- 2026-08-04
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software-development, cloud-infrastructure, managed-service-providers, critical-infrastructure, manufacturing
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 17
- Updates
- 2026-08-04 · revalidated 1× · latest source
A critical integer-overflow-to-buffer-overflow vulnerability in libssh2's ssh2_transport_read() (all releases through 1.11.1) lets a malicious or compromised SSH server send an oversized, attacker-controlled packet_length field to corrupt client heap memory pre-authentication, with potential remote code execution. A public proof-of-concept (local trigger/harness, not a turnkey remote exploit) was published in the 'exploitarium' GitHub archive on 2026-06-29; no in-the-wild exploitation has been confirmed and CISA lists no exploitation rating.
How Public PoC Released for Critical libssh2 Client-Side SSH works
CVE-2026-55200 is a critical (CVSS 9.2) out-of-bounds write vulnerability in libssh2, the widely embedded C SSH client library used by curl, Git GUI clients, PHP's SFTP functionality, backup/automation agents, firmware updaters, and countless IoT/embedded appliances. The flaw lives in ssh2_transport_read() in src/transport.c, the function responsible for parsing incoming SSH packets during the transport-layer handshake, before any cryptographic authentication of the server has occurred.
The root cause is a missing upper-bound check on the SSH packet_length field. RFC 4253 caps this field at 35,000 bytes, but libssh2's parser only rejected values below 1 -- it never validated the upper bound before using packet_length in an arithmetic buffer-size calculation. A malicious server can send packet_length = 0xFFFFFFFF. When combined with mac_len and auth_len in the allocation-size computation, 32-bit integer wraparound occurs (e.g. 0xFFFFFFFF + 0 + 16 wraps to 15, then +4 == 19), causing libssh2 to allocate a tiny buffer (as little as 19 bytes) while subsequent packet-processing code still operates against the original, enormous packet_length value. The result is a linear heap buffer overflow with attacker-influenced write length, corrupting adjacent heap memory and creating a path to remote code execution on the connecting client.
Because the trigger occurs during transport-layer parsing, exploitation requires no credentials and no user interaction -- only that the client initiate an SSH/SFTP connection to a server the attacker controls or has compromised (e.g. via DNS hijack, BGP hijack, MITM, or a trojanized/malicious update/mirror server). This makes automated tooling -- CI/CD SSH deploy steps, backup agents, firmware updaters, and any outbound SSH automation reaching untrusted or attacker-influenced hosts -- a particularly attractive target class, inverting the usual SSH threat model (client-side rather than server-side compromise).
The defect is a near-exact structural recurrence of CVE-2019-3855, an integer overflow at the same code location in libssh2 1.8.1 patched seven years earlier, underscoring a recurring pattern of insufficiently defensive length-field handling in libssh2's packet parser.
Maintainers merged the fix via pull request #2052 on 2026-06-12, landing in commit 97acf3dfda80c91c3a8c9f2372546301d4a1a7a8, which adds validation rejecting packet_length values exceeding LIBSSH2_PACKET_MAXPAYLOAD before any arithmetic is performed. VulnCheck published the CVE on 2026-06-17 (reported by researcher Tristan Madani). On 2026-06-29, a public PoC was published in the 'exploitarium' GitHub archive under path libssh2-cve-2026-55200-poc, authored by GitHub user 'bikini'. The PoC repository includes: cve_2026_55200_probe.c (a standalone C11 arithmetic verifier demonstrating the 32-bit wraparound), libpwn_cve_2026_55200_server.py (a malicious SSH server implementing an encrypted trigger over curve25519-sha256 key exchange and chacha20-poly1305 cipher to reach the vulnerable code path realistically), libpwn_local_rce_harness.c (a controlled vulnerable target modeling the allocation-to-overflow pattern), and libpwn_local_rce_exploit.py (a local exploit driver demonstrating RCE against the harness). The repository explicitly restricts use to local research targets, owned systems, or authorized lab/CTF/HTB instances, and the PoC as published is a verified local trigger/harness rather than a reliable, turnkey remote exploit -- real-world reliability against a live target still depends on the embedding application's build, allocator behavior, ASLR/hardening, and how libssh2 is linked.
CVE-2026-55200 was published alongside two related libssh2 flaws disclosed in the same research/patch cycle: CVE-2026-55199 (CVSS 8.2), a pre-authentication denial-of-service in the SSH_MSG_EXT_INFO handler (src/packet.c) where an attacker-controlled nr_extensions field can be set to 0xFFFFFFFF, driving the client into a ~4-billion-iteration parsing loop that pins CPU for 60+ seconds (fixed in commit 1762685); and CVE-2025-15661 (CVSS 8.3), an SFTP heap over-read. Multiple downstream vulnerability trackers additionally reference CVE-2026-7598 (integer overflow RCE), CVE-2026-58050 (buffer overflow), and CVE-2026-58051 (use-after-free) as part of the broader libssh2 hardening cycle in this period.
CVSS scoring varies materially by methodology: NIST's CVSS v3.1 base score is 8.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L), VulnCheck's CVSS v3.1 assessment is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), while the CVSS v4.0 score used for hunt prioritization is 9.2 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). CISA's Known Exploited Vulnerabilities catalog does not list CVE-2026-55200 as of this writing, and CISA's exploitation-observed rating remains 'none' -- there is no confirmed in-the-wild exploitation, only public PoC availability. EPSS scores the CVE at approximately 0.73% (50th percentile), reflecting that despite the severity, near-term mass exploitation is not currently predicted, though the combination of critical severity, pre-auth trigger, zero user interaction, and public PoC materially elevates weaponization risk. As libssh2 is frequently statically linked, patched builds of the library alone are insufficient -- every downstream application and appliance embedding libssh2 must be individually identified, rebuilt, and redeployed, a remediation burden the advisories flag as the primary operational risk of this disclosure.
MITRE ATT&CK techniques used in TL-2026-1226
Defense Evasion
T1027 Obfuscated Files or Information; T1211 Exploitation for Stealth
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Command and Control
T1071 Application Layer Protocol; T1571 Non-Standard Port; T1573 Encrypted Channel
Initial Access
T1189 Drive-by Compromise; T1190 Exploit Public-Facing Application
Execution
T1203 Exploitation for Client Execution
Impact
T1489 Service Stop; T1499 Endpoint Denial of Service
Persistence
T1554 Compromise Host Software Binary
Collection
Resource Development
T1585 Establish Accounts; T1587 Develop Capabilities; T1588 Obtain Capabilities
Reconnaissance
Affected products and versions in Public PoC Released for Critical libssh2 Client-Side SSH
- libssh2 — libssh2
Vulnerable versions: 0 through 1.11.1; all releases up to and including 1.11.1
Fixed in: commit 97acf3dfda80c91c3a8c9f2372546301d4a1a7a8 (post-1.11.1) - curl — curl (statically linked with libssh2)
Vulnerable versions: builds linking libssh2 <= 1.11.1
Fixed in: builds relinked against patched libssh2 - PHP — PHP SFTP/SSH2 extensions using libssh2
Vulnerable versions: extensions bundling/linking libssh2 <= 1.11.1
Fixed in: rebuilt against patched libssh2 - Git — Git GUI clients using libssh2 transport
Vulnerable versions: clients bundling libssh2 <= 1.11.1
Fixed in: clients bundling patched libssh2
Remediation for Public PoC Released for Critical libssh2 Client-Side SSH
Patches
- libssh2 commit 97acf3dfda80c91c3a8c9f2372546301d4a1a7a8 (fixes CVE-2026-55200, PR #2052, merged 2026-06-12)
- libssh2 commit 1762685 (fixes companion CVE-2026-55199 pre-auth DoS)
Immediate actions
- Inventory all systems, applications, and appliances that dynamically or statically link libssh2 (curl builds, Git GUI clients, PHP SFTP extensions, backup agents, firmware updaters, embedded/IoT devices)
- Upgrade libssh2 to a build containing commit 97acf3dfda80c91c3a8c9f2372546301d4a1a7a8 (merged via PR #2052) or a vendor/distro backport
- Restrict outbound SSH client connectivity to an allowlist of trusted, verified hosts at the network perimeter
- Enforce strict SSH host key verification / known_hosts pinning in all libssh2-based client tooling to reduce MITM/rogue-server exposure
Workarounds
- Disable or pause SSH-based CI/CD automation and backup jobs that reach unverified or third-party hosts until patched
- Block egress SSH connections to any server outside a pinned, trusted host-key allowlist
- Monitor for application crashes or anomalous memory faults occurring during the SSH transport/key-exchange handshake phase
Longer-term hardening
- Rebuild and redeploy every application with statically linked libssh2 rather than relying on shared-library patching alone
- Deploy network signatures/IDS rules detecting SSH packets with packet_length or extension-count fields exceeding RFC 4253's 35,000-byte cap
- Harden CI/CD, backup, and firmware-update pipelines that perform outbound SSH so they cannot reach attacker-influenced or unverified endpoints
- Enable OS-level exploit mitigations (ASLR, hardened heap allocators, SELinux/AppArmor) on hosts running libssh2-linked automation
CVEs associated with Public PoC Released for Critical libssh2 Client-Side SSH
CVE-2026-55200, CVE-2026-55199, CVE-2025-15661
Weaknesses (CWE) in Public PoC Released for Critical libssh2 Client-Side SSH
CWE-680, CWE-190, CWE-787, CWE-835
Timeline of Public PoC Released for Critical libssh2 Client-Side SSH
- CVE-2019-3855, a nearly identical integer overflow at the same code location in libssh2 1.8.1, is patched -- establishing the recurring pattern that CVE-2026-55200 later re-exposes.
- Companion fix for CVE-2026-55199 further identified as libssh2 PR #1864 (full commit 17626857d20b3c9a1addfa45979dadcee1cd84a4), adding return-value checks and capping nr_extensions at 1024 in src/packet.c.
- libssh2 maintainers merge pull request #2052, landing commit 97acf3dfda80c91c3a8c9f2372546301d4a1a7a8, adding upper-bound validation for packet_length in ssh2_transport_read().
- VulnCheck publishes CVE-2026-55200, reported by researcher Tristan Madani, with a CVSS v4.0 score of 9.2 (Critical).
- The Hacker News publishes coverage of the public PoC release, driving broader security-community awareness.
- A public proof-of-concept -- a local trigger/harness rather than a turnkey remote exploit -- is published in the 'exploitarium' GitHub archive by user 'bikini', including an arithmetic verifier, a malicious SSH server implementation, and a local RCE exploit driver.
- Arctic Wolf and other security vendors publish mitigation guidance urging inventory of libssh2-linked applications and urgent patching.
- NVD record for CVE-2026-55200 is last modified, reflecting CVSS v3.1 and v4.0 scoring, CWE-680 classification, and CPE affected-product data.
- As of this analysis, CISA lists no exploitation-observed rating for CVE-2026-55200 and it does not appear in the CISA KEV catalog; no in-the-wild exploitation has been confirmed.
- Follow-up report reconfirms CVE-2026-55200 remains absent from the CISA KEV catalog with no confirmed in-the-wild exploitation; libgit2 (pygit2/nodegit/Rugged bindings) documented as an additional libssh2-linked downstream consumer.
Update history for TL-2026-1226
- 2026-08-04 — Critical Library Vulnerabilities: libssh2 Pre-Auth Heap Overflow (CVE-2026-55200, CVSS 9.2) and libheif Grid Tile Heap Overflow (CVE-2026-32740, CVSS 8.8): What changed No change to severity, exploitability, or status -- still CRITICAL / POC_PUBLIC / ACTIVE at CVSS 9.2. The report adds fix-version specificity (libssh2 1.11.2) and reconfirms CISA KEV/in-the-wild-exploitation status is unchanged
Sources cited for Public PoC Released for Critical libssh2 Client-Side SSH
- Public PoC Released for Critical libssh2 CVE-2026-55200 Client-Side SSH Flaw
- libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write (GHSA-r8mh-x5qv-7gg2)
- exploitarium/libssh2-cve-2026-55200-poc
- CVE-2026-55200 Detail - NVD
- Critical Remote Code Execution Vulnerability in libssh2 Client Library Require Urgent Mitigation - Arctic Wolf
- libssh2 and alt-libssh2 CVEs (CVE-2026-55200, CVE-2026-55199, CVE-2025-15661) - CloudLinux
- CVE-2026-55200: Critical libssh2 RCE Flaw Affects All Versions
- libssh2 CVE-2026-55200 Shows Why Outbound SSH Is an Attack Surface
- CVE-2026-55200: libssh2 Remote Code Execution Vulnerability - SentinelOne
- libssh2 Pre-Authentication DoS via SSH_MSG_EXT_INFO Handler - VulnCheck Advisory (CVE-2026-55199)
- libssh2 through 1.11.1, fixed in commit 1762685 (GHSA-3cfq-4xx4-rmpg / CVE-2026-55199)
- libssh2 fix commit 97acf3dfda80c91c3a8c9f2372546301d4a1a7a8
- libssh2 pull request #2052 (fix for CVE-2026-55200)
- CVE-2026-55200 - Security Bug Tracker - Debian
- CVE-2026-55200 - libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c
Threats related to Public PoC Released for Critical libssh2 Client-Side SSH
Detection coverage for TL-2026-1226
As of 2026-08-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1226 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.