{"id":"CVE-2026-55199","aliases":["ALPINE-CVE-2026-55199","AZL-108513","AZL-90933","BELL-CVE-2026-55199","DEBIAN-CVE-2026-55199","EUVD-2026-37782","GHSA-3cfq-4xx4-rmpg","JLSEC-2026-660","MGASA-2026-0273","OESA-2026-3014","OESA-2026-3015","OESA-2026-3016","OESA-2026-3222","RHSA-2026:29950","ROOT-OS-DEBIAN-11-CVE-2026-55199","SUSE-SU-2026:22284-1","SUSE-SU-2026:22364-1","SUSE-SU-2026:22438-1","SUSE-SU-2026:23187-1","SUSE-SU-2026:3074-1","SUSE-SU-2026:3076-1","SUSE-SU-2026:3082-1","SUSE-SU-2026:3525-1","UBUNTU-CVE-2026-55199","openSUSE-SU-2026:11109-1","openSUSE-SU-2026:21057-1"],"status":"published","title":"libssh2 - Pre-Authentication DoS via SSH_MSG_EXT_INFO Handler","description":"libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can set nr_extensions to 0xFFFFFFFF during key exchange, causing the client to spin in a tight CPU loop for over 60 seconds because return values from _libssh2_get_string() are unchecked and the session timeout does not apply to CPU-bound loops.","severity":{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00918,"percentile":0.60502,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-835"],"published":"2026-06-17T18:44:18Z","modified":"2026-11-09T02:47:22Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"chromium-rust","fixed_in":["1.96.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"libssh2","fixed_in":["1.11.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"libssh2","fixed_in":["1.11.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"libssh2","fixed_in":["1.11.1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libssh2","fixed_in":["1.11.1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"rust","fixed_in":["1.96.1-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"libssh2","fixed_in":["1.11.1-4"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"libssh2","fixed_in":["1.11.1-r3"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"libssh2","fixed_in":["1.11.1-r2"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"libssh2","fixed_in":["1.11.1-r3"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"rust","fixed_in":["1.96.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libssh2","fixed_in":["1.11.1-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libssh2","fixed_in":["1.11.1-4"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibSSH2_jll","fixed_in":["1.11.102+0"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"libssh2","fixed_in":["1.11.0-8.oe2403sp4"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"libssh2","fixed_in":["1.9.0-2+deb11u1.aikido.4","1.9.0-2+deb11u1.aikido.5","1.9.0-2+deb11u1.root.io.3"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-libssh2","fixed_in":["1.9.0-2+deb11u1.aikido.4","1.9.0-2+deb11u1.aikido.5","1.9.0-2+deb11u1.root.io.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"libssh2_org","fixed_in":["1.11.0-3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libssh2_org","fixed_in":["1.11.0-150200.9.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"libssh2_org","fixed_in":["1.11.0-150200.9.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libssh2_org","fixed_in":["1.11.0-150200.9.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libssh2_org","fixed_in":["1.11.0-150200.9.5.1","1.11.0-150000.4.32.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libssh2_org","fixed_in":["1.11.0-150200.9.5.1","1.11.0-150000.4.32.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"libssh2_org","fixed_in":["1.11.0-150200.9.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"libssh2_org","fixed_in":["1.11.0-150200.9.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libssh2_org","fixed_in":["1.11.0-150200.9.5.1","1.11.0-150000.4.32.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"libssh2_org","fixed_in":["1.11.0-150200.9.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libssh2_org","fixed_in":["1.11.0-150200.9.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"libssh2_org","fixed_in":["1.11.0-150200.9.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libssh2_org","fixed_in":["1.11.0-150600.20.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"libssh2_org","fixed_in":["1.11.0-150600.20.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"libssh2_org","fixed_in":["1.11.0-150600.20.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libssh2","fixed_in":["1.11.0-4.1ubuntu0.24.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"libssh2","fixed_in":["1.11.1-1ubuntu0.25.10.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libssh2","fixed_in":["1.11.1-1ubuntu0.26.04.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"chromium-rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.96.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.96.1-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.85.0"},{"last_affected":"1.98.1-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-4"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.0-r4"},{"fixed":"1.11.1-r3"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11.1-r0"},{"fixed":"1.11.1-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.0-r4"},{"fixed":"1.11.1-r3"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.69.0-r10"},{"fixed":"1.96.1-r0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-1+deb13u1"}]}],"versions":["1.11.1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-4"}]}],"versions":["1.11.1-1","1.11.1-2","1.11.1-3"]},{"source":"osv","ecosystem":"Julia","package":"LibSSH2_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.11.102+0"}]}]},{"source":"osv","ecosystem":"Mageia:10","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-2.1.mga10"}]}],"bundled":6},{"source":"osv","ecosystem":"Mageia:9","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-1.1.mga9"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-10.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-7.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-7.oe2403sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-8.oe2403sp4"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.1-8.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libssh2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.1-8.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libssh2-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.1-8.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Root:Debian:11","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-2+deb11u1.aikido.4"},{"fixed":"1.9.0-2+deb11u1.aikido.5"},{"fixed":"1.9.0-2+deb11u1.root.io.3"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-2+deb11u1.aikido.4"},{"fixed":"1.9.0-2+deb11u1.aikido.5"},{"fixed":"1.9.0-2+deb11u1.root.io.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"libssh2_org","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-160000.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libssh2_org","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-160000.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libssh2_org","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-160000.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"libssh2_org","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"libssh2_org","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-slfo.1.1_2.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libssh2_org","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-150200.9.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"libssh2_org","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-150200.9.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libssh2_org","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-150200.9.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libssh2_org","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-150200.9.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libssh2_org","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-150200.9.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"libssh2_org","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-150200.9.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"libssh2_org","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-150200.9.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libssh2_org","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-150200.9.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"libssh2_org","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-150200.9.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libssh2_org","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-150200.9.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"libssh2_org","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-150200.9.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libssh2_org","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-150600.20.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"libssh2_org","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-150600.20.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"libssh2_org","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-150600.20.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libssh2_org","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-150000.4.32.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libssh2_org","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-150000.4.32.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libssh2_org","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-150000.4.32.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"libssh2_org","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-29.18.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"libssh2_org","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-29.18.1"}]}],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-4.1ubuntu0.24.04.2"}]}],"versions":["1.11.0-2","1.11.0-3","1.11.0-4","1.11.0-4.1build1","1.11.0-4.1build2","1.11.0-4.1ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-1ubuntu0.25.10.2"}]}],"versions":["1.11.1-1","1.11.1-1build1","1.11.1-1ubuntu0.25.10.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-1ubuntu0.26.04.2"}]}],"versions":["1.11.1-1build1","1.11.1-1build2","1.11.1-1ubuntu0.26.04.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libssh2_org","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libssh2_org","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-160000.4.1"}]}],"bundled":2}],"products":[{"vendor":"libssh2","product":"libssh2"}],"references":[{"url":"https://github.com/libssh2/libssh2/pull/1864","tags":["issue-tracking","patch","Patch","fix","web","article","report"]},{"url":"https://github.com/libssh2/libssh2/commit/17626857d20b3c9a1addfa45979dadcee1cd84a4","tags":["patch","Patch","fix","web","article"]},{"url":"https://www.vulncheck.com/advisories/libssh2-pre-authentication-dos-via-ssh-msg-ext-info-handler","tags":["third-party-advisory","Third Party Advisory","advisory","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55199","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-3cfq-4xx4-rmpg","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-55199","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-55199","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55199.json","tags":["advisory"]},{"url":"https://github.com/libssh2/libssh2","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-55199","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0273.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35616","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NRU63FODXZBBO73NFWUI32A2A36ETDQZ/","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/23/10","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/23/11","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00276.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZREI4LITT4U2ZXPEEVVNALFKPLXGLAFM/","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/SRBHQ76PA4ZHTWY5F4ESYPYF3G2NLGWI/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-8486-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8532-1","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3014","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15661","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3015","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3016","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3222","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:29950","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-55200","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-55199","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_29950.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490128","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55199","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490127","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55200","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55200","tags":["advisory"]},{"url":"https://github.com/libssh2/libssh2/commit/97acf3dfda80c91c3a8c9f2372546301d4a1a7a8","tags":["article"]},{"url":"https://github.com/libssh2/libssh2/pull/2052","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/libssh2-out-of-bounds-write-via-unchecked-packet-length-in-transport-c","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622284-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268530","tags":["report"]},{"url":"https://bugzilla.suse.com/1268531","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55200","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622364-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622438-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623187-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1263890","tags":["report"]},{"url":"https://bugzilla.suse.com/1268546","tags":["report"]},{"url":"https://bugzilla.suse.com/1269567","tags":["report"]},{"url":"https://bugzilla.suse.com/1269568","tags":["report"]},{"url":"https://bugzilla.suse.com/1272734","tags":["report"]},{"url":"https://bugzilla.suse.com/1272735","tags":["report"]},{"url":"https://bugzilla.suse.com/1272736","tags":["report"]},{"url":"https://bugzilla.suse.com/1272737","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-15661","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66035","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7598","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263074-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1227490","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263076-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263082-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263525-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-55199","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-55199","title":"libssh2 - Pre-Authentication DoS via SSH_MSG_EXT_INFO Handler","description":"libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can set nr_extensions to 0xFFFFFFFF during key exchange, causing the client to spin in a tight CPU loop for over 60 seconds because return values from _libssh2_get_string() are unchecked and the session timeout does not apply to CPU-bound loops.","status":"published","published":"2026-06-17T18:44:18.048Z","modified":"2026-11-08T14:05:21.081Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-835"],"updated_at":"2026-11-08T15:43:33.322657Z"}],"euvd":[{"id":"EUVD-2026-37782","description":"libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can set nr_extensions to 0xFFFFFFFF during key exchange, causing the client to spin in a tight CPU loop for over 60 seconds because return values from _libssh2_get_string() are unchecked and the session timeout does not apply to CPU-bound loops.","status":"published","published":"2026-06-17T18:44:18Z","modified":"2026-11-08T14:05:21Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-08T15:13:08.252361Z"}],"ghsa":[{"id":"GHSA-3cfq-4xx4-rmpg","title":"libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service...","description":"libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can set nr_extensions to 0xFFFFFFFF during key exchange, causing the client to spin in a tight CPU loop for over 60 seconds because return values from _libssh2_get_string() are unchecked and the session timeout does not apply to CPU-bound loops.","status":"published","published":"2026-06-17T21:34:39Z","modified":"2026-06-17T21:34:45Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T15:08:52.922102Z"}],"nvd":[{"id":"CVE-2026-55199","description":"libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can set nr_extensions to 0xFFFFFFFF during key exchange, causing the client to spin in a tight CPU loop for over 60 seconds because return values from _libssh2_get_string() are unchecked and the session timeout does not apply to CPU-bound loops.","status":"published","published":"2026-06-17T20:17:28.52Z","modified":"2026-07-14T22:17:17.043Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:12:24.544761Z"}],"osv":[{"id":"ALPINE-CVE-2026-55199","description":"libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can set nr_extensions to 0xFFFFFFFF during key exchange, causing the client to spin in a tight CPU loop for over 60 seconds because return values from _libssh2_get_string() are unchecked and the session timeout does not apply to CPU-bound loops.","status":"published","published":"2026-06-17T20:17:28.52Z","modified":"2026-11-03T06:33:06.306145209Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:15:37.282377Z"},{"id":"BELL-CVE-2026-55199","status":"published","published":"2026-06-20T06:12:58.264068Z","modified":"2026-07-18T07:15:06.192823074Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:24.657778Z"},{"id":"CVE-2026-55199","title":"libssh2 - Pre-Authentication DoS via SSH_MSG_EXT_INFO Handler","description":"libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can set nr_extensions to 0xFFFFFFFF during key exchange, causing the client to spin in a tight CPU loop for over 60 seconds because return values from _libssh2_get_string() are unchecked and the session timeout does not apply to CPU-bound loops.","status":"published","published":"2026-06-17T18:44:18.048Z","modified":"2026-11-09T07:04:14.007989271Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-835"],"updated_at":"2026-11-09T03:16:17.543303Z"},{"id":"DEBIAN-CVE-2026-55199","description":"libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can set nr_extensions to 0xFFFFFFFF during key exchange, causing the client to spin in a tight CPU loop for over 60 seconds because return values from _libssh2_get_string() are unchecked and the session timeout does not apply to CPU-bound loops.","status":"published","published":"2026-06-17T20:17:28.52Z","modified":"2026-10-01T03:03:19.162152045Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:57.236551Z"},{"id":"JLSEC-2026-660","title":"libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service...","description":"libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the `SSH_MSG_EXT_INFO` handler in `src/packet.c` that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can set `nr_extensions` to 0xFFFFFFFF during key exchange, causing the client to spin in a tight CPU loop for over 60 seconds because return values from `_libssh2_get_string()` are unchecked and the session timeout does not apply to CPU-bound loops.","status":"published","published":"2026-07-10T13:57:40.607Z","modified":"2026-07-25T18:24:44.160535499Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:47:19.003546Z"},{"id":"OESA-2026-3014","title":"libssh2 security update","description":"libssh2 is a library implementing the SSH2 protocol as defined by Internet Drafts: SECSH-TRANS(22), SECSH-USERAUTH(25), SECSH-CONNECTION(23), SECSH-ARCH(20), SECSH-FILEXFER(06)*, SECSH-DHGEX(04), and SECSH-NUMBERS(10).\r\n\r\nSecurity Fix(es):\n\nlibssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c that allows a malicious SSH server or man-in-the-middle attacker to disclose heap memory contents or cause a crash by sending a crafted SSH_FXP_NAME response. Attackers can supply a link_len value larger than the actual packet data in SSH_FXP_NAME responses for SFTP READLINK and REALPATH operations, triggering a heap buffer over-read of up to target_len minus one bytes due to the missing validation of available packet buffer size before the memcpy operation.(CVE-2025-15661)\n\nlibssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can set nr_extensions to 0xFFFFFFFF during key exchange, causing the client to spin in a tight CPU loop for over 60 seconds because return values from _libssh2_get_string() are unchecked and the session timeout does not apply to CPU-bound loops.(CVE-2026-55199)","status":"published","published":"2026-07-19T11:11:54Z","modified":"2026-08-18T01:21:18.167850902Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3015","title":"libssh2 security update","description":"libssh2 is a library implementing the SSH2 protocol as defined by Internet Drafts: SECSH-TRANS(22), SECSH-USERAUTH(25), SECSH-CONNECTION(23), SECSH-ARCH(20), SECSH-FILEXFER(06)*, SECSH-DHGEX(04), and SECSH-NUMBERS(10).\r\n\r\nSecurity Fix(es):\n\nlibssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c that allows a malicious SSH server or man-in-the-middle attacker to disclose heap memory contents or cause a crash by sending a crafted SSH_FXP_NAME response. Attackers can supply a link_len value larger than the actual packet data in SSH_FXP_NAME responses for SFTP READLINK and REALPATH operations, triggering a heap buffer over-read of up to target_len minus one bytes due to the missing validation of available packet buffer size before the memcpy operation.(CVE-2025-15661)\n\nlibssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can set nr_extensions to 0xFFFFFFFF during key exchange, causing the client to spin in a tight CPU loop for over 60 seconds because return values from _libssh2_get_string() are unchecked and the session timeout does not apply to CPU-bound loops.(CVE-2026-55199)","status":"published","published":"2026-07-19T11:11:54Z","modified":"2026-08-18T01:21:18.224163303Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3016","title":"libssh2 security update","description":"libssh2 is a library implementing the SSH2 protocol as defined by Internet Drafts: SECSH-TRANS(22), SECSH-USERAUTH(25), SECSH-CONNECTION(23), SECSH-ARCH(20), SECSH-FILEXFER(06)*, SECSH-DHGEX(04), and SECSH-NUMBERS(10).\r\n\r\nSecurity Fix(es):\n\nlibssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c that allows a malicious SSH server or man-in-the-middle attacker to disclose heap memory contents or cause a crash by sending a crafted SSH_FXP_NAME response. Attackers can supply a link_len value larger than the actual packet data in SSH_FXP_NAME responses for SFTP READLINK and REALPATH operations, triggering a heap buffer over-read of up to target_len minus one bytes due to the missing validation of available packet buffer size before the memcpy operation.(CVE-2025-15661)\n\nlibssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can set nr_extensions to 0xFFFFFFFF during key exchange, causing the client to spin in a tight CPU loop for over 60 seconds because return values from _libssh2_get_string() are unchecked and the session timeout does not apply to CPU-bound loops.(CVE-2026-55199)","status":"published","published":"2026-07-19T11:11:54Z","modified":"2026-08-18T01:21:18.168342472Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3222","title":"libssh2 security update","description":"libssh2 is a library implementing the SSH2 protocol as defined by Internet Drafts: SECSH-TRANS(22), SECSH-USERAUTH(25), SECSH-CONNECTION(23), SECSH-ARCH(20), SECSH-FILEXFER(06)*, SECSH-DHGEX(04), and SECSH-NUMBERS(10).\r\n\r\nSecurity Fix(es):\n\nlibssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can set nr_extensions to 0xFFFFFFFF during key exchange, causing the client to spin in a tight CPU loop for over 60 seconds because return values from _libssh2_get_string() are unchecked and the session timeout does not apply to CPU-bound loops.(CVE-2026-55199)","status":"published","published":"2026-08-01T11:12:05Z","modified":"2026-08-18T01:21:26.012633453Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"RHSA-2026:29950","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-06-26T11:46:36Z","modified":"2026-10-20T10:07:08Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"UBUNTU-CVE-2026-55199","description":"libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can set nr_extensions to 0xFFFFFFFF during key exchange, causing the client to spin in a tight CPU loop for over 60 seconds because return values from _libssh2_get_string() are unchecked and the session timeout does not apply to CPU-bound loops.","status":"published","published":"2026-06-17T20:17:00Z","modified":"2026-09-05T06:15:45.849966608Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"AZL-108513","title":"CVE-2026-55199 affecting package rust 1.98.1-1","description":"libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can set nr_extensions to 0xFFFFFFFF during key exchange, causing the client to spin in a tight CPU loop for over 60 seconds because return values from _libssh2_get_string() are unchecked and the session timeout does not apply to CPU-bound loops.","status":"published","published":"2026-06-17T20:17:28Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:18.199293Z"},{"id":"AZL-90933","title":"CVE-2026-55199 affecting package libssh2 for versions less than 1.11.1-4","description":"libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can set nr_extensions to 0xFFFFFFFF during key exchange, causing the client to spin in a tight CPU loop for over 60 seconds because return values from _libssh2_get_string() are unchecked and the session timeout does not apply to CPU-bound loops.","status":"published","published":"2026-06-17T20:17:28Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.633663Z"},{"id":"MGASA-2026-0273","title":"Updated libssh2 packages fix security vulnerabilities","description":"The updated packages fix security vulnerabilities:\nHeap Buffer Over-read via sftp_symlink() in sftp.c. (CVE-2025-15661)\nlibssh2 userauth.c userauth_password integer overflow. (CVE-2026-7598)\nPre-Authentication DoS via SSH_MSG_EXT_INFO Handler. (CVE-2026-55199)\nOut-of-Bounds Write via Unchecked packet_length in transport.c.\n(CVE-2026-55200)\nInteger Overflow in publickey Subsystem Attribute Allocation.\n(CVE-2026-58050)\nFree of Uninitialized Pointer in publickey List Cleanup.\n(CVE-2026-58051)\n","status":"published","published":"2026-07-20T19:06:32Z","modified":"2026-07-20T19:20:56.035464062Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11109-1","title":"libssh2-1-1.11.1-3.1 on GA media","description":"These are all security issues fixed in the libssh2-1-1.11.1-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-23T00:00:00Z","modified":"2026-06-24T09:00:05.16911932Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21057-1","title":"Security update for libssh2_org","description":"This update for libssh2_org fixes the following issues\n\n- CVE-2026-55199: pre-Authentication DoS via SSH_MSG_EXT_INFO Handler (bsc#1268530).\n- CVE-2026-55200: out-of-Bounds write via Unchecked packet_length in transport.c (bsc#1268531).\n","status":"published","published":"2026-06-25T11:51:43Z","modified":"2026-06-30T18:24:29.364161176Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-55199","title":"CVE-2026-55199 in libssh2 - Patched by Root","description":"Root has patched CVE-2026-55199 in the libssh2 package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-08-20T16:07:02Z","modified":"2026-08-20T17:30:06.871735742Z","updated_at":"2026-11-02T15:53:30.44348Z"},{"id":"SUSE-SU-2026:22284-1","title":"Security update for libssh2_org","description":"This update for libssh2_org fixes the following issues\n\n- CVE-2026-55199: pre-Authentication DoS via SSH_MSG_EXT_INFO Handler (bsc#1268530).\n- CVE-2026-55200: out-of-Bounds write via Unchecked packet_length in transport.c (bsc#1268531).\n","status":"published","published":"2026-06-25T11:50:54Z","modified":"2026-06-30T18:24:34.44373343Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22364-1","title":"Security update for libssh2_org","description":"This update for libssh2_org fixes the following issues\n\n- CVE-2026-55199: pre-Authentication DoS via SSH_MSG_EXT_INFO Handler (bsc#1268530).\n- CVE-2026-55200: out-of-Bounds write via Unchecked packet_length in transport.c (bsc#1268531).\n","status":"published","published":"2026-06-25T11:50:54Z","modified":"2026-07-02T18:24:13.791624609Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22438-1","title":"Security update for libssh2_org","description":"This update for libssh2_org fixes the following issue\n\n- CVE-2026-55199: pre-Authentication DoS via SSH_MSG_EXT_INFO Handler (bsc#1268530).\n","status":"published","published":"2026-07-01T09:39:42Z","modified":"2026-07-03T18:24:21.09824066Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:23187-1","title":"Security update for libssh2_org","description":"This update for libssh2_org fixes the following issues:\n\n- CVE-2025-15661: out-of-bounds heap read vulnerability in the `sftp_symlink()` function in `src/sftp.c` (bsc#1268546).\n- CVE-2026-7598: integer overflow in function `userauth_password` of file `src/userauth.c` (bsc#1263890).\n- CVE-2026-55199: pre-authentication DoS via the `SSH_MSG_EXT_INFO` handler (bsc#1268530).\n- CVE-2026-58050: heap buffer overflow due to missing bounds check in attribute count of publickey-subsystem response\n  (bsc#1269568).\n- CVE-2026-58051: uninitialized pointer freed when malformed responses are sent by an SSH server (bsc#1269567).\n- CVE-2026-66032: arbitrary code execution via double-free in SFTP session (bsc#1272737).\n- CVE-2026-66033: denial of service via integer underflow in AES-GCM cipher negotiation (bsc#1272736).\n- CVE-2026-66034: information disclosure and potential arbitrary code execution via heap out-of-bounds read\n  (bsc#1272735).\n- CVE-2026-66035: arbitrary code execution via heap buffer overflow during SSH negotiation (bsc#1272734).\n","status":"published","published":"2026-08-17T16:37:24Z","modified":"2026-08-26T18:23:31.171326675Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:3074-1","title":"Security update for libssh2_org","description":"This update for libssh2_org fixes the following issue\n\nSecurity changes:\n\n- CVE-2026-55199: pre-Authentication DoS via SSH_MSG_EXT_INFO Handler (bsc#1268530).\n\nOther changes:\n\n- rebuild libssh2_org against openssl 1.1.1, enabling ed25519 support. (bsc#1227490)\n","status":"published","published":"2026-07-16T09:59:21Z","modified":"2026-07-17T09:30:05.851115606Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3076-1","title":"Security update for libssh2_org","description":"This update for libssh2_org fixes the following issue\n\n- CVE-2026-55199: pre-Authentication DoS via SSH_MSG_EXT_INFO Handler (bsc#1268530).\n","status":"published","published":"2026-07-16T13:04:25Z","modified":"2026-07-17T09:30:07.396474976Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3082-1","title":"Security update for libssh2_org","description":"This update for libssh2_org fixes the following issue\n\n- CVE-2026-55199: pre-Authentication DoS via SSH_MSG_EXT_INFO Handler (bsc#1268530).\n","status":"published","published":"2026-07-16T16:17:32Z","modified":"2026-07-17T09:30:07.394422706Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3525-1","title":"Security update for libssh2_org","description":"This update for libssh2_org fixes the following issues:\n\n- CVE-2025-15661: out-of-bounds heap read vulnerability in the `sftp_symlink()` function in `src/sftp.c` (bsc#1268546).\n- CVE-2026-7598: integer overflow in function `userauth_password` of file `src/userauth.c` (bsc#1263890).\n- CVE-2026-55199: pre-authentication DoS via the `SSH_MSG_EXT_INFO` handler (bsc#1268530).\n- CVE-2026-58050: heap buffer overflow due to missing bounds check in attribute count of publickey-subsystem response\n  (bsc#1269568).\n- CVE-2026-58051: uninitialized pointer freed when malformed responses are sent by an SSH server (bsc#1269567).\n- CVE-2026-66032: arbitrary code execution via double-free in SFTP session (bsc#1272737).\n- CVE-2026-66033: denial of service via integer underflow in AES-GCM cipher negotiation (bsc#1272736).\n- CVE-2026-66034: information disclosure and potential arbitrary code execution via heap out-of-bounds read\n  (bsc#1272735).\n- CVE-2026-66035: arbitrary code execution via heap buffer overflow during SSH negotiation (bsc#1272734).\n","status":"published","published":"2026-08-07T13:08:26Z","modified":"2026-08-08T09:00:06.084070296Z","updated_at":"2026-11-02T15:54:04.987808Z"}]}}