USN-8486-1: libssh2 vulnerabilities
It was discovered that libssh2 incorrectly handled the sftpsymlink() function. A malicious SSH server or machine-in-the-middle attacker could possibly use this issue to obtain sensitive information or cause a denial of service. (CVE-2025-15661) It was discovered that libssh2 had a pre-authentication denial of service vulnerability in the SSHMSGEXTINFO handler. A malicious SSH server could possibly use this issue to cause a client CPU exhaustion loop, resulting in a denial of service. (CVE-2026-55199) It was discovered that libssh2 incorrectly handled packet length fields. A remote attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-55200)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/libssh2-1t64to a version that resolves this vulnerability.Fixed in 1.11.1-1ubuntu0.26.04.2 - Upgrade
Upgrade
ubuntu/libssh2-1t64to a version that resolves this vulnerability.Fixed in 1.11.1-1ubuntu0.25.10.2 - Upgrade
Upgrade
ubuntu/libssh2-1t64to a version that resolves this vulnerability.Fixed in 1.11.0-4.1ubuntu0.24.04.2
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What is the severity of USN-8486-1?
The severity of USN-8486-1 is high due to critical vulnerabilities in libssh2.
How do I fix USN-8486-1?
To fix USN-8486-1, update your libssh2 package to the latest available version.
What vulnerabilities are addressed in USN-8486-1?
USN-8486-1 addresses multiple vulnerabilities including CVE-2026-55200, CVE-2026-55199, and CVE-2025-15661.
Who is affected by USN-8486-1?
Any system using an affected version of the libssh2 library is at risk from USN-8486-1.
What can happen if USN-8486-1 is not addressed?
If USN-8486-1 is not addressed, attackers may exploit the vulnerabilities to execute remote code or perform other malicious activities.