{"id":"CVE-2026-55200","aliases":["ALPINE-CVE-2026-55200","AZL-108519","AZL-90927","BELL-CVE-2026-55200","DEBIAN-CVE-2026-55200","EUVD-2026-37784","GHSA-r8mh-x5qv-7gg2","JLSEC-2026-661","MGASA-2026-0273","RHSA-2026:29950","ROOT-OS-DEBIAN-11-CVE-2026-55200","ROOT-OS-DEBIAN-12-CVE-2026-55200","SUSE-SU-2026:22284-1","SUSE-SU-2026:22364-1","UBUNTU-CVE-2026-55200","openSUSE-SU-2026:11109-1","openSUSE-SU-2026:21057-1"],"status":"published","title":"libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c","description":"libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.","severity":{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.03877,"percentile":0.903,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-680"],"published":"2026-06-17T19:03:15Z","modified":"2026-11-09T02:47:22Z","exploits":[{"source":"pocgithub","id":"ashrafzaryouh/CVE-2026-55200","title":"ashrafzaryouh/CVE-2026-55200","date":"2026-06-23","url":"https://github.com/ashrafzaryouh/CVE-2026-55200"},{"source":"pocgithub","id":"xd20111/CVE-2026-55200","title":"xd20111/CVE-2026-55200","date":"2026-06-29","url":"https://github.com/xd20111/CVE-2026-55200"},{"source":"pocgithub","id":"kaleth4/CVE-2026-55200","title":"kaleth4/CVE-2026-55200","date":"2026-07-02","url":"https://github.com/kaleth4/CVE-2026-55200"}],"fixes":[{"ecosystem":"Alpine:v3.24","package":"chromium-rust","fixed_in":["1.96.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"libssh2","fixed_in":["1.11.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"libssh2","fixed_in":["1.11.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"libssh2","fixed_in":["1.11.1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libssh2","fixed_in":["1.11.1-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"rust","fixed_in":["1.96.1-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"libssh2","fixed_in":["1.11.1-3"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"libssh2","fixed_in":["1.11.1-r3"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"libssh2","fixed_in":["1.11.1-r2"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"libssh2","fixed_in":["1.11.1-r3"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"rust","fixed_in":["1.96.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libssh2","fixed_in":["1.11.1-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libssh2","fixed_in":["1.11.1-4"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibSSH2_jll","fixed_in":["1.11.102+0"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"libssh2","fixed_in":["1.9.0-2+deb11u1.aikido.4","1.9.0-2+deb11u1.aikido.5","1.9.0-2+deb11u1.root.io.2","1.9.0-2+deb11u1.root.io.3"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-libssh2","fixed_in":["1.9.0-2+deb11u1.aikido.4","1.9.0-2+deb11u1.aikido.5","1.9.0-2+deb11u1.root.io.2","1.9.0-2+deb11u1.root.io.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"libssh2","fixed_in":["1.11.1-1ubuntu0.25.10.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libssh2","fixed_in":["1.11.1-1ubuntu0.26.04.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"chromium-rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.96.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.96.1-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.85.0"},{"last_affected":"1.98.1-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-3"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.0-r4"},{"fixed":"1.11.1-r3"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11.1-r0"},{"fixed":"1.11.1-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.0-r4"},{"fixed":"1.11.1-r3"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.69.0-r10"},{"fixed":"1.96.1-r0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-1+deb13u1"}]}],"versions":["1.11.1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-4"}]}],"versions":["1.11.1-1","1.11.1-2","1.11.1-3"]},{"source":"osv","ecosystem":"Julia","package":"LibSSH2_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.11.102+0"}]}]},{"source":"osv","ecosystem":"Mageia:10","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-2.1.mga10"}]}],"bundled":6},{"source":"osv","ecosystem":"Mageia:9","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-1.1.mga9"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.1-8.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libssh2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.1-8.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libssh2-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.1-8.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Root:Debian:11","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-2+deb11u1.aikido.4"},{"fixed":"1.9.0-2+deb11u1.aikido.5"},{"fixed":"1.9.0-2+deb11u1.root.io.2"},{"fixed":"1.9.0-2+deb11u1.root.io.3"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-2+deb11u1.aikido.4"},{"fixed":"1.9.0-2+deb11u1.aikido.5"},{"fixed":"1.9.0-2+deb11u1.root.io.2"},{"fixed":"1.9.0-2+deb11u1.root.io.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"libssh2_org","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-160000.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libssh2_org","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-160000.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libssh2_org","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-160000.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-1ubuntu0.25.10.2"}]}],"versions":["1.11.1-1","1.11.1-1build1","1.11.1-1ubuntu0.25.10.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libssh2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-1ubuntu0.26.04.2"}]}],"versions":["1.11.1-1build1","1.11.1-1build2","1.11.1-1ubuntu0.26.04.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libssh2_org","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libssh2_org","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.1-160000.4.1"}]}],"bundled":2}],"products":[{"vendor":"libssh2","product":"libssh2"}],"references":[{"url":"https://github.com/libssh2/libssh2/pull/2052","tags":["issue-tracking","patch","Patch","fix","web","article","report"]},{"url":"https://github.com/libssh2/libssh2/commit/97acf3dfda80c91c3a8c9f2372546301d4a1a7a8","tags":["patch","Patch","fix","web","article"]},{"url":"https://www.vulncheck.com/advisories/libssh2-out-of-bounds-write-via-unchecked-packet-length-in-transport-c","tags":["third-party-advisory","Third Party Advisory","advisory","web","article"]},{"url":"https://web.archive.org/web/20260623211210/https://github.com/bikini/exploitarium/tree/main/libssh2-cve-2026-55200-poc","tags":["exploit","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55200","tags":["web","advisory"]},{"url":"https://github.com/bikini/exploitarium/tree/main/libssh2-cve-2026-55200-poc","tags":["web"]},{"url":"https://github.com/advisories/GHSA-r8mh-x5qv-7gg2","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-55200","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-55200","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55200.json","tags":["advisory"]},{"url":"https://github.com/libssh2/libssh2","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-55200","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0273.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35616","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NRU63FODXZBBO73NFWUI32A2A36ETDQZ/","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/23/10","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/23/11","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00276.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZREI4LITT4U2ZXPEEVVNALFKPLXGLAFM/","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/SRBHQ76PA4ZHTWY5F4ESYPYF3G2NLGWI/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-8486-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8532-1","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:29950","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-55200","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-55199","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_29950.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490128","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55199","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55199","tags":["advisory"]},{"url":"https://github.com/libssh2/libssh2/commit/17626857d20b3c9a1addfa45979dadcee1cd84a4","tags":["article"]},{"url":"https://github.com/libssh2/libssh2/pull/1864","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/libssh2-pre-authentication-dos-via-ssh-msg-ext-info-handler","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490127","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55200","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622284-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268530","tags":["report"]},{"url":"https://bugzilla.suse.com/1268531","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55200","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622364-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-55200","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-15661","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7598","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-55200","title":"libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c","description":"libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.","status":"published","published":"2026-06-17T19:03:15.183Z","modified":"2026-11-08T14:05:21.714Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-680"],"updated_at":"2026-11-08T15:43:33.322657Z"}],"euvd":[{"id":"EUVD-2026-37784","description":"libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.","status":"published","published":"2026-06-17T19:03:15Z","modified":"2026-11-08T14:05:21Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-08T15:13:08.252361Z"}],"ghsa":[{"id":"GHSA-r8mh-x5qv-7gg2","title":"libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in...","description":"libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.","status":"published","published":"2026-06-17T21:34:39Z","modified":"2026-06-30T15:30:33Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-680"],"updated_at":"2026-11-02T15:09:05.934873Z"}],"nvd":[{"id":"CVE-2026-55200","description":"libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.","status":"published","published":"2026-06-17T20:17:28.667Z","modified":"2026-10-22T19:17:55.937Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high","assessor":"primary"}],"cwes":["CWE-680"],"updated_at":"2026-11-02T14:12:24.544761Z"}],"osv":[{"id":"ALPINE-CVE-2026-55200","description":"libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.","status":"published","published":"2026-06-17T20:17:28.667Z","modified":"2026-11-03T06:32:58.096072326Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-03T07:16:09.603409Z"},{"id":"BELL-CVE-2026-55200","status":"published","published":"2026-06-20T06:12:58.322757Z","modified":"2026-07-18T07:15:06.094320518Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:28:24.657778Z"},{"id":"CVE-2026-55200","title":"libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c","description":"libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.","status":"published","published":"2026-06-17T19:03:15.183Z","modified":"2026-11-09T07:04:13.610284787Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-680"],"updated_at":"2026-11-09T03:16:17.543303Z"},{"id":"DEBIAN-CVE-2026-55200","description":"libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.","status":"published","published":"2026-06-17T20:17:28.667Z","modified":"2026-10-23T17:47:27.626346767Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:45:57.236551Z"},{"id":"JLSEC-2026-661","title":"libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in...","description":"libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in `ssh2_transport_read()` that fails to enforce upper bounds on `packet_length` field. Remote attackers can send crafted SSH packets with excessively large `packet_length` values to corrupt heap memory and achieve remote code execution.","status":"published","published":"2026-07-10T13:57:40.607Z","modified":"2026-07-25T18:24:44.799211143Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"},{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"}],"updated_at":"2026-11-02T15:47:19.003546Z"},{"id":"RHSA-2026:29950","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-06-26T11:46:36Z","modified":"2026-10-20T10:07:08Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"UBUNTU-CVE-2026-55200","description":"libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.","status":"published","published":"2026-06-17T20:17:00Z","modified":"2026-10-28T20:17:47.762976501Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"},{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"AZL-108519","title":"CVE-2026-55200 affecting package rust 1.98.1-1","description":"libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.","status":"published","published":"2026-06-17T20:17:28Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:18.199293Z"},{"id":"AZL-90927","title":"CVE-2026-55200 affecting package libssh2 for versions less than 1.11.1-3","description":"libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.","status":"published","published":"2026-06-17T20:17:28Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.633663Z"},{"id":"MGASA-2026-0273","title":"Updated libssh2 packages fix security vulnerabilities","description":"The updated packages fix security vulnerabilities:\nHeap Buffer Over-read via sftp_symlink() in sftp.c. (CVE-2025-15661)\nlibssh2 userauth.c userauth_password integer overflow. (CVE-2026-7598)\nPre-Authentication DoS via SSH_MSG_EXT_INFO Handler. (CVE-2026-55199)\nOut-of-Bounds Write via Unchecked packet_length in transport.c.\n(CVE-2026-55200)\nInteger Overflow in publickey Subsystem Attribute Allocation.\n(CVE-2026-58050)\nFree of Uninitialized Pointer in publickey List Cleanup.\n(CVE-2026-58051)\n","status":"published","published":"2026-07-20T19:06:32Z","modified":"2026-07-20T19:20:56.035464062Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11109-1","title":"libssh2-1-1.11.1-3.1 on GA media","description":"These are all security issues fixed in the libssh2-1-1.11.1-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-23T00:00:00Z","modified":"2026-06-24T09:00:05.16911932Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21057-1","title":"Security update for libssh2_org","description":"This update for libssh2_org fixes the following issues\n\n- CVE-2026-55199: pre-Authentication DoS via SSH_MSG_EXT_INFO Handler (bsc#1268530).\n- CVE-2026-55200: out-of-Bounds write via Unchecked packet_length in transport.c (bsc#1268531).\n","status":"published","published":"2026-06-25T11:51:43Z","modified":"2026-06-30T18:24:29.364161176Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-55200","title":"CVE-2026-55200 in libssh2 - Patched by Root","description":"Root has patched CVE-2026-55200 in the libssh2 package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-08-20T16:07:02Z","modified":"2026-08-20T17:30:07.514998395Z","updated_at":"2026-11-02T15:53:30.44348Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-55200","title":"CVE-2026-55200 in libssh2 - Patched by Root","description":"Root has patched CVE-2026-55200 in the libssh2 package for Root:Debian:12. Multiple fixed versions available.","status":"withdrawn","published":"2026-08-25T11:14:15Z","modified":"2026-09-07T08:00:08.127170813Z","updated_at":"2026-11-02T15:53:32.298225Z"},{"id":"SUSE-SU-2026:22284-1","title":"Security update for libssh2_org","description":"This update for libssh2_org fixes the following issues\n\n- CVE-2026-55199: pre-Authentication DoS via SSH_MSG_EXT_INFO Handler (bsc#1268530).\n- CVE-2026-55200: out-of-Bounds write via Unchecked packet_length in transport.c (bsc#1268531).\n","status":"published","published":"2026-06-25T11:50:54Z","modified":"2026-06-30T18:24:34.44373343Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22364-1","title":"Security update for libssh2_org","description":"This update for libssh2_org fixes the following issues\n\n- CVE-2026-55199: pre-Authentication DoS via SSH_MSG_EXT_INFO Handler (bsc#1268530).\n- CVE-2026-55200: out-of-Bounds write via Unchecked packet_length in transport.c (bsc#1268531).\n","status":"published","published":"2026-06-25T11:50:54Z","modified":"2026-07-02T18:24:13.791624609Z","updated_at":"2026-11-02T15:54:03.080707Z"}]}}