Public PoC Released for Critical libssh2 Client-Side SSH Flaw (CVE-2026-55200) — Threadlinqs Intelligence
As of 2026-07-11, Public PoC Released for Critical libssh2 Client-Side SSH Flaw (CVE-2026-55200) is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 15 indicators of compromise.
Threat ID: TL-2026-1226 · Severity: CRITICAL · CVSS: 9.2 · Status: ACTIVE · Category: VULNERABILITY
A critical integer-overflow-to-buffer-overflow vulnerability in libssh2's ssh2_transport_read() (all releases through 1.11.1) lets a malicious or compromised SSH server send an oversized,
CVE-2026-55200 is a critical (CVSS 9.2) out-of-bounds write vulnerability in libssh2, the widely embedded C SSH client library used by curl, Git GUI clients, PHP's SFTP functionality, backup/automation agents, firmware updaters, and countless IoT/embedded appliances. The flaw lives in ssh2_transport_read() in src/transport.c, the function responsible for parsing incoming SSH packets during the transport-layer handshake, before any cryptographic authentication of the server has occurred.
The root cause is a missing upper-bound check on the SSH packet_length field. RFC 4253 caps this field at 35,000 bytes, but libssh2's parser only rejected values below 1 -- it never validated the upper bound before using packet_length in an arithmetic buffer-size calculation. A malicious server can send packet_length = 0xFFFFFFFF. When combined with mac_len and auth_len in the allocation-size computation, 32-bit integer wraparound occurs (e.g. 0xFFFFFFFF + 0 + 16 wraps to 15, then +4 == 19), causing libssh2 to allocate a tiny buffer (as little as 19 bytes) while subsequent packet-processing code still operates against the original, enormous packet_length value. The result is a linear heap buffer overflow with attacker-influenced write length, corrupting adjacent heap memory and creating a path to remote code execution on the connecting client.
Because the trigger occurs during transport-layer parsing, exploitation requires no credentials and no user interaction -- only that the client initiate an SSH/SFTP connection to a server the attacker controls or has compromised (e.g. via DNS hijack, BGP hijack, MITM, or a trojanized/malicious update/mirror server). This makes automated tooling -- CI/CD SSH deploy steps, backup agents, firmware updaters, and any outbound SSH automation reaching untrusted or attacker-influenced hosts -- a particularly attractive target class, inverting the usual SSH threat model (client-side rather than server-side compromise).
The defect is a near-exact structural recurrence of CVE-2019-3855, an integer overflow at the same code location in libssh2 1.8.1 patched seven years earlier, underscoring a recurring pattern of insufficiently defensive length-field handling in libssh2's packet parser.
Maintainers merged the fix via pull request #2052 on 2026-06-12, landing in commit 97acf3dfda80c91c3a8c9f2372546301d4a1a7a8, which adds validation rejecting packet_length values exceeding LIBSSH2_PACKET_MAXPAYLOAD before any arithmetic is performed. VulnCheck published the CVE on 2026-06-17 (reported by researcher Tristan Madani). On 2026-06-29, a public PoC was published in the 'exploitarium' GitHub archive under path libssh2-cve-2026-55200-poc, authored by GitHub user 'bikini'. The PoC repository includes: cve_2026_55200_probe.c (a standalone C11 arithmetic verifier demonstrating the 32-bit wraparound), libpwn_cve_2026_55200_server.py (a malicious SSH server implementing an encrypted trigger over curve25519-sha256 key exchange and chacha20-poly1305 cipher to reach the vulnerable code path realistically), libpwn_local_rce_harness.c (a controlled vulnerable target modeling the allocation-to-overflow pattern), and libpwn_local_rce_exploit.py (a local exploit driver demonstrating RCE against the harness). The repository explicitly restricts use to local research targets, owned systems, or authorized lab/CTF/HTB instances, and the PoC as published is a verified local trigger/harness rather than a reliable, turnkey remote exploit -- real-world reliability against a live target still depends on the embedding application's build, allocator behavior, ASLR/hardening, and how libssh2 is linked.
CVE-2026-55200 was published alongside two related libssh2 flaws disclosed in the same research/patch cycle: CVE-2026-55199 (CVSS 8.2), a pre-authentication denial-of-service in the SSH_MSG_EXT_INFO handler (src/packet.c) where an attacker-controlled nr_extensions field can be set to 0xFFFFFFFF, driving the client into a ~4-billion-iteration parsin
Weaknesses (CWE)
CWE-680, CWE-190, CWE-787
Target sectors: technology, software-development, cloud-infrastructure, managed-service-providers, critical-infrastructure, manufacturing
Target regions: Global
Detections & IOCs
As of 2026-07-26, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 15 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-55200, CVE-2026-55199, CVE-2025-15661, T1190, T1189, T1203, T1554, T1068, T1211, T1557, T1071, T1571, T1499