CVE-2026-55199 libssh2 - Pre-Authentication DoS via SSH_MSG_EXT_INFO Handler
A malicious SSH server can cause client CPU exhaustion via a crafted extension count in libssh2, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55199?
CVE-2026-55199 is a high-severity denial of service vulnerability in libssh2, published on 17 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can set nr_extensions to 0xFFFFFFFF during key exchange, causing the client to spin in a tight CPU loop for over 60 seconds because return values from _libssh2_get_string() are unchecked and the session timeout does not apply to CPU-bound loops.
Weakness: CWE-835
Which versions are affected by CVE-2026-55199?
It affects 1 product.
Linux distribution packages (18)
libssh2_org SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 1.11.0-150000.4.32.1 |
libssh2_org SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 1.11.0-150200.9.5.1 |
libssh2_org SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 1.11.0-150000.4.32.1 |
libssh2_org SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 1.11.0-150200.9.5.1 |
libssh2_org SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | All versions | 1.11.0-150200.9.5.1 |
libssh2_org SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | All versions | 1.11.0-150200.9.5.1 |
libssh2_org SUSE:Linux Enterprise Micro 5.3 | All versions | 1.11.0-150200.9.5.1 |
libssh2_org SUSE:Linux Enterprise Micro 5.4 | All versions | 1.11.0-150200.9.5.1 |
libssh2_org SUSE:Linux Enterprise Micro 5.5 | All versions | 1.11.0-150200.9.5.1 |
libssh2_org SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 1.11.0-150600.20.3.1 |
libssh2_org SUSE:Linux Enterprise Server 15 SP4-LTSS | All versions | 1.11.0-150000.4.32.1 |
libssh2_org SUSE:Linux Enterprise Server 15 SP4-LTSS | All versions | 1.11.0-150200.9.5.1 |
libssh2_org SUSE:Linux Enterprise Server 15 SP5-LTSS | All versions | 1.11.0-150200.9.5.1 |
libssh2_org SUSE:Linux Enterprise Server 15 SP6-LTSS | All versions | 1.11.0-150600.20.3.1 |
libssh2_org SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | All versions | 1.11.0-150200.9.5.1 |
libssh2_org SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | All versions | 1.11.0-150200.9.5.1 |
libssh2_org SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | All versions | 1.11.0-150600.20.3.1 |
libssh2_org SUSE:Linux Micro 6.0 | All versions | 1.11.0-3.1 |
Products include Libssh2 Libssh2.
How do I fix CVE-2026-55199?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-55199 being exploited?
There is no known exploitation of CVE-2026-55199 in the wild and no public exploit code.
Other vulnerabilities in libssh2
- CVE-2026-55200 libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c
- CVE-2026-66032 libssh2 Double-Free Heap Corruption via sftp_open()
- CVE-2026-66033 libssh2 Integer Underflow DoS via AES-GCM Cipher Negotiation
- CVE-2026-58050 libssh2 - Integer Overflow in publickey Subsystem Attribute Allocation
- CVE-2026-58051 libssh2 - Free of Uninitialized Pointer in publickey List Cleanup
Sources
Also known as ALPINE-CVE-2026-55199, AZL-90933, BELL-CVE-2026-55199, DEBIAN-CVE-2026-55199, ECHO-3e02-3a01-4ae3, GHSA-3cfq-4xx4-rmpg and 9 more.