Critical libssh2 Vulnerabilities Enable Remote Code Execution and Denial-of-Service Attacks

Researchers have disclosed two serious security vulnerabilities affecting libssh2, a widely used open-source SSH library embedded in numerous applications, operating systems, network devices, backup solutions, and file transfer tools. The most severe issue, tracked as CVE-2026-55200, has received a CVSS score of 9.2 and stems from an out-of-bounds write condition. The flaw occurs because libssh2 fails to properly enforce its internal packet size limits, allowing an attacker to send specially crafted SSH packets with oversized packet_length values. Successful exploitation can corrupt heap memory and potentially lead to remote code execution. According to the advisory, the attack requires no authentication, no user interaction, and no special privileges, making exposed vulnerable systems particularly attractive targets. A second vulnerability, CVE-2026-55199, has been rated 8.2 in severity and can be exploited by a malicious SSH server against connecting clients. During the SSH authentication and key exchange process, a server can advertise an excessively large number of supported extensions, causing vulnerable clients to enter a CPU-intensive loop for more than a minute, resulting in a denial-of-service condition. The vulnerabilities affect libssh2 version 1.11.1 and all earlier releases. Because libssh2 is a dependency for software such as curl when using SCP and SFTP functionality, as well as many Linux distributions and embedded devices, the potential impact extends across a large software ecosystem. The maintainers have already published code fixes through GitHub commits, but an official release containing the patches has not yet been issued. Distribution maintainers and downstream projects are currently working to backport the fixes and update their packages.