Logo
›
›vulnerability›CVE-2026-55200
Name
CVE-2026-55200
Source
NVD ( link)Debian ( link)
Description
libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.
CWEs
CWE-680
Published Date
Updated Date
Workaround
-
Advisories
https://github.com/libssh2/libssh2/commit/97acf3dfda80c91c3a8c9f2372546301d4a1a7a8Patch
https://github.com/libssh2/libssh2/pull/2052Patch
https://www.vulncheck.com/advisories/libssh2-out-of-bounds-write-via-unchecked-packet-length-in-transport-cThird Party Advisory
https://web.archive.org/web/20260623211210/https://github.com/bikini/exploitarium/tree/main/libssh2-cve-2026-55200-pocExploit

Analysis#

Affected Component
Analysis
libssh2
Patched

Vulnerability Ratings#

9.2
CVSSv4
8.1
CVSSv31
8.3
CVSSv31
NaN
other

Others affected components#

Name
Project
Project Version
Version
Status
libssh2
buildroot
2025.02.x
1.11.1
Patched
libssh2
buildroot
master
1.11.1
Patched
libssh2
openwrt
master
1.11.1-r1
Exploitable
libssh2
openwrt
openwrt-25.12
1.11.1-r1
Exploitable
libssh2
yocto
kirkstone
1.10.0
Exploitable
libssh2
yocto
master
1.11.1
Patched

Resolved with patches#

libssh2 (buildroot:2025.02.x)

#
Title
Author
Resolve
1
transport.c: Additional boundary checks for packet length
Will Cosgrove <will@panic.com>
CVE-2026-55200

libssh2 (buildroot:master)

#
Title
Author
Resolve
1
transport.c: Additional boundary checks for packet length
Will Cosgrove <will@panic.com>
CVE-2026-55200

libssh2 (yocto:master)

#
Title
Author
Resolve
1
transport.c: Additional boundary checks for packet length
Will Cosgrove <will@panic.com>
CVE-2026-55200

libssh2 (yocto:scarthgap)

#
Title
Author
Resolve
1
transport.c: Additional boundary checks for packet length
Will Cosgrove <will@panic.com>
CVE-2026-55200