Every CVE Search/ Get API key

CVE-2026-55200

libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c

9.2 CriticalPublic exploitFix available

libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

3.88%Up 3.3 points since Jun 18, 2026
90%50%10%1%

What each source reports

CVE List Score used 9.2

libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c

libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.

Record
CVE-2026-55200
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-680
Updated
2026-11-02
EUVDEUVD-2026-37784 9.2

libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.

Record
EUVD-2026-37784
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-r8mh-x5qv-7gg2 9.2

libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in...

libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.

Record
GHSA-r8mh-x5qv-7gg2
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-680
Updated
2026-11-02
NVD 9.2

libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.

Record
CVE-2026-55200
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
Weakness
CWE-680
Updated
2026-11-02
OSVALPINE-CVE-2026-55200 8.3

libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.

Record
ALPINE-CVE-2026-55200
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
Updated
2026-11-03
OSVBELL-CVE-2026-55200 8.3
Record
BELL-CVE-2026-55200
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
Updated
2026-11-02
Show 14 moreShow less
OSV 9.2

libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c

libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.

Record
CVE-2026-55200
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-680
Updated
2026-11-02
OSVDEBIAN-CVE-2026-55200 8.3

libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.

Record
DEBIAN-CVE-2026-55200
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
Updated
2026-11-02
OSVJLSEC-2026-661 9.2

libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in...

libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.

Record
JLSEC-2026-661
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
Updated
2026-11-02
OSVRHSA-2026:29950 7.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:29950
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2026-55200 9.2

libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.

Record
UBUNTU-CVE-2026-55200
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVAZL-108519 No score

CVE-2026-55200 affecting package rust 1.98.1-1

libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.

Record
AZL-108519
Updated
2026-11-05
OSVAZL-90927 No score

CVE-2026-55200 affecting package libssh2 for versions less than 1.11.1-3

libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.

Record
AZL-90927
Updated
2026-11-05
OSVMGASA-2026-0273 No score

Updated libssh2 packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Heap Buffer Over-read via sftp_symlink() in sftp.c. (CVE-2025-15661) libssh2 userauth.c userauth_password integer overflow. (CVE-2026-7598) Pre-Authentication DoS via SSH_MSG_EXT_INFO Handler. (CVE-2026-55199) Out-of-Bounds Write via Unchecked packet_length in transport.c. (CVE-2026-55200) Integer Overflow in publickey Subsystem Attribute Allocation. (CVE-2026-58050) Free of Uninitialized Pointer in publickey List Cleanup. (CVE-2026-58051)

Record
MGASA-2026-0273
Updated
2026-11-02
OSVopenSUSE-SU-2026:11109-1 No score

libssh2-1-1.11.1-3.1 on GA media

These are all security issues fixed in the libssh2-1-1.11.1-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11109-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21057-1 No score

Security update for libssh2_org

This update for libssh2_org fixes the following issues

  • CVE-2026-55199: pre-Authentication DoS via SSH_MSG_EXT_INFO Handler (bsc#1268530).
  • CVE-2026-55200: out-of-Bounds write via Unchecked packet_length in transport.c (bsc#1268531).
Record
openSUSE-SU-2026:21057-1
Updated
2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2026-55200 No score

CVE-2026-55200 in libssh2 - Patched by Root

Root has patched CVE-2026-55200 in the libssh2 package for Root:Debian:11. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-11-CVE-2026-55200
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2026-55200 No score

CVE-2026-55200 in libssh2 - Patched by Root

Root has patched CVE-2026-55200 in the libssh2 package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2026-55200
Updated
2026-11-02
OSVSUSE-SU-2026:22284-1 No score

Security update for libssh2_org

This update for libssh2_org fixes the following issues

  • CVE-2026-55199: pre-Authentication DoS via SSH_MSG_EXT_INFO Handler (bsc#1268530).
  • CVE-2026-55200: out-of-Bounds write via Unchecked packet_length in transport.c (bsc#1268531).
Record
SUSE-SU-2026:22284-1
Updated
2026-11-02
OSVSUSE-SU-2026:22364-1 No score

Security update for libssh2_org

This update for libssh2_org fixes the following issues

  • CVE-2026-55199: pre-Authentication DoS via SSH_MSG_EXT_INFO Handler (bsc#1268530).
  • CVE-2026-55200: out-of-Bounds write via Unchecked packet_length in transport.c (bsc#1268531).
Record
SUSE-SU-2026:22364-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
chromium-rust
Alpine:v3.24
 before 1.96.1-r0
1.96.1-r0
libssh2
Alpine:v3.21
 before 1.11.1-r2
1.11.1-r2
libssh2
Alpine:v3.22
 before 1.11.1-r2
1.11.1-r2
libssh2
Alpine:v3.23
 before 1.11.1-r3
1.11.1-r3
libssh2
Alpine:v3.24
 before 1.11.1-r3
1.11.1-r3
rust
Alpine:v3.24
 before 1.96.1-r0
1.96.1-r0
rust
Azure Linux:3
 1.85.0 to 1.98.1-1 None known
libssh2
Azure Linux:3
 before 1.11.1-3
1.11.1-3
libssh2
Alpaquita:23
 1.10.0-r4 up to 1.11.1-r3
1.11.1-r3
libssh2
Alpaquita:25
 1.11.1-r0 up to 1.11.1-r2
1.11.1-r2
Show 19 moreShow less
Affected packages
PackageAffectedFixed
libssh2
Alpaquita:stream
 1.10.0-r4 up to 1.11.1-r3
1.11.1-r3
rust
Alpaquita:stream
 1.69.0-r10 up to 1.96.1-r0
1.96.1-r0
libssh2
Debian:13
 before 1.11.1-1+deb13u1, plus listed versions
1.11.1-1
1.11.1-1+deb13u1
libssh2
Debian:14
 before 1.11.1-4, plus listed versions
1.11.1-11.11.1-21.11.1-3
1.11.1-4
LibSSH2_jll
Julia
 before 1.11.102+0
1.11.102+0
libssh2
Mageia:10
From an advisory covering 6 CVEs
 before 1.11.1-2.1.mga10
1.11.1-2.1.mga10
libssh2
Mageia:9
From an advisory covering 6 CVEs
 before 1.11.0-1.1.mga9
1.11.0-1.1.mga9
libssh2
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:1.11.1-8.hum1
0:1.11.1-8.hum1
libssh2-devel
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:1.11.1-8.hum1
0:1.11.1-8.hum1
libssh2-docs
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:1.11.1-8.hum1
0:1.11.1-8.hum1
libssh2
Root:Debian:11
 before 1.9.0-2+deb11u1.aikido.4
1.9.0-2+deb11u1.aikido.41.9.0-2+deb11u1.aikido.51.9.0-2+deb11u1.root.io.21.9.0-2+deb11u1.root.io.3
rootio-libssh2
Root:Debian:11
 before 1.9.0-2+deb11u1.aikido.4
1.9.0-2+deb11u1.aikido.41.9.0-2+deb11u1.aikido.51.9.0-2+deb11u1.root.io.21.9.0-2+deb11u1.root.io.3
libssh2_org
SUSE:Linux Micro 6.2
From an advisory covering 2 CVEs
 before 1.11.1-160000.4.1
1.11.1-160000.4.1
libssh2_org
SUSE:Linux Enterprise Server 16.0
From an advisory covering 2 CVEs
 before 1.11.1-160000.4.1
1.11.1-160000.4.1
libssh2_org
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 2 CVEs
 before 1.11.1-160000.4.1
1.11.1-160000.4.1
libssh2
Ubuntu:25.10
 before 1.11.1-1ubuntu0.25.10.2, plus listed versions
1.11.1-11.11.1-1build11.11.1-1ubuntu0.25.10.1
1.11.1-1ubuntu0.25.10.2
libssh2
Ubuntu:26.04:LTS
 before 1.11.1-1ubuntu0.26.04.2, plus listed versions
1.11.1-1build11.11.1-1build21.11.1-1ubuntu0.26.04.1
1.11.1-1ubuntu0.26.04.2
libssh2_org
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 1.11.1-3.1
1.11.1-3.1
libssh2_org
openSUSE:Leap 16.0
From an advisory covering 2 CVEs
 before 1.11.1-160000.4.1
1.11.1-160000.4.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHub0xBlackash/CVE-2026-552002026-06-23
PoC in GitHubxd20111/CVE-2026-552002026-06-29
PoC in GitHubkaleth4/CVE-2026-552002026-07-02

History

History
RecordedChangedSources
affected
factsOSV
affected, exploitsOSV
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-55200 is a critical vulnerability (CVSS 9.2) in Libssh2, published June 17, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.88%, the 90th percentile. Fixed in chromium-rust 1.96.1-r0.

References

Show 39 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open