CVE-2026-55199: libssh2 - Pre-Authentication DoS via SSH_MSG_EXT_INFO Handler
Last updated 30 June 2026
Other sources
libssh2 - Pre-Authentication DoS via SSHMSGEXTINFO Handler
— Microsoft
libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSHMSGEXTINFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can set nrextensions to 0xFFFFFFFF during key exchange, causing the client to spin in a tight CPU loop for over 60 seconds because return values from libssh2getstring() are unchecked and the session timeout does not apply to CPU-bound loops.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.11.1-4 - Upgrade
Upgrade
debian/libssh2to a version that resolves this vulnerability.Fixed in 1.10.0-3Fixed in 1.10.0-3+deb12u1Fixed in 1.11.1-1+deb13u2Fixed in 1.11.1-1+deb13u1Fixed in 1.11.1-6 - Upgrade
Upgrade
alpine/chromium-rustto a version that resolves this vulnerability.Fixed in 1.96.1-r0 - Upgrade
Upgrade
alpine/libssh2to a version that resolves this vulnerability.Fixed in 1.11.1-r2 - Upgrade
Upgrade
alpine/libssh2to a version that resolves this vulnerability.Fixed in 1.11.1-r3 - Upgrade
Upgrade
alpine/rustto a version that resolves this vulnerability.Fixed in 1.96.1-r0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 1762685 - Upgrade
Upgrade
libssh2to a version that resolves this vulnerability.Fixed in 1.11.1 - Compensating control
Apply protections that limit exposure to untrusted SSH servers during pre-authentication (e.g., firewall/ACL rules restricting which servers can accept SSH connections) to reduce the chance a client will process malicious SSH_MSG_EXT_INFO messages.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55199?
The severity of CVE-2026-55199 is rated as medium with a score of 5.9.
How do I fix CVE-2026-55199?
To fix CVE-2026-55199, update to libssh2 version 1.11.1 or later.
What type of vulnerability is CVE-2026-55199?
CVE-2026-55199 is a pre-authentication denial of service vulnerability.
What can an attacker do with CVE-2026-55199?
An attacker can exploit CVE-2026-55199 by sending a crafted extension count value from a malicious SSH server to cause client CPU exhaustion.
In which component does CVE-2026-55199 exist?
CVE-2026-55199 exists in the SSH_MSG_EXT_INFO handler of the libssh2 library.