CVE-2026-55200 libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c
Remote attackers can achieve code execution by sending crafted SSH packets that trigger an out-of-bounds write in the libssh2 library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55200?
CVE-2026-55200 is a critical memory corruption vulnerability in libssh2, published on 17 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.
Weakness: CWE-680
Which versions are affected by CVE-2026-55200?
It affects 1 product.
Products include Libssh2 Libssh2.
How do I fix CVE-2026-55200?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-55200 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55200 exists.
Public exploit code: 3 proofs of concept on GitHub.
Other vulnerabilities in libssh2
- CVE-2026-66032 libssh2 Double-Free Heap Corruption via sftp_open()
- CVE-2026-66033 libssh2 Integer Underflow DoS via AES-GCM Cipher Negotiation
- CVE-2026-58050 libssh2 - Integer Overflow in publickey Subsystem Attribute Allocation
- CVE-2026-58051 libssh2 - Free of Uninitialized Pointer in publickey List Cleanup
- CVE-2025-15661 libssh2 - Heap Buffer Over-read via sftp_symlink() in sftp.c
Sources
Also known as ALPINE-CVE-2026-55200, AZL-90927, BELL-CVE-2026-55200, DEBIAN-CVE-2026-55200, ECHO-81b6-9726-71c6, GHSA-r8mh-x5qv-7gg2 and 4 more.