CVE-2026-55200: libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c
Last updated 30 June 2026
Other sources
libssh2 - Out-of-Bounds Write via Unchecked packetlength in transport.c
— Microsoft
libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2transportread() that fails to enforce upper bounds on packetlength field. Remote attackers can send crafted SSH packets with excessively large packetlength values to corrupt heap memory and achieve remote code execution.
— MITRE
libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2transportread() that fails to enforce upper bounds on packetlength field. Remote attackers can send crafted SSH packets with excessively large packetlength values to corrupt heap memory and achieve remote code execution.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.11.1-3 - Upgrade
Upgrade
ubuntu/libssh2to a version that resolves this vulnerability.Fixed in 1.11.1-1ubuntu0.25.10.2 - Upgrade
Upgrade
ubuntu/libssh2to a version that resolves this vulnerability.Fixed in 1.11.1-1ubuntu0.26.04.2 - Upgrade
Upgrade
debian/libssh2to a version that resolves this vulnerability.Fixed in 1.10.0-3Fixed in 1.10.0-3+deb12u1Fixed in 1.11.1-1+deb13u2Fixed in 1.11.1-1+deb13u1Fixed in 1.11.1-6 - Upgrade
Upgrade
alpine/chromium-rustto a version that resolves this vulnerability.Fixed in 1.96.1-r0 - Upgrade
Upgrade
alpine/libssh2to a version that resolves this vulnerability.Fixed in 1.11.1-r2 - Upgrade
Upgrade
alpine/libssh2to a version that resolves this vulnerability.Fixed in 1.11.1-r3 - Upgrade
Upgrade
alpine/rustto a version that resolves this vulnerability.Fixed in 1.96.1-r0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55200?
The severity of CVE-2026-55200 is high, with a CVSS score of 8.1.
What does CVE-2026-55200 affect?
CVE-2026-55200 affects libssh2 versions up to 1.11.1.
How do I fix CVE-2026-55200?
To fix CVE-2026-55200, update libssh2 to the version that includes the fix from commit 7acf3df.
What type of attack is associated with CVE-2026-55200?
CVE-2026-55200 is associated with a remote code execution attack due to an out-of-bounds write.
What are the potential consequences of CVE-2026-55200?
The potential consequences of CVE-2026-55200 include heap memory corruption, which could lead to unauthorized access or control over the affected system.