Critical libssh2 Vulnerability Lets Remote Attackers Execute Code via Crafted SSH Packets

A critical security vulnerability has been identified in libssh2, a widely used client-side SSH library. This flaw allows remote attackers to execute code by sending specially crafted SSH packets.

The vulnerability, tracked as CVE-2026-55200, has a CVSS score of 9.2 and affects libssh2 versions up to and including 1.11.1. The issue has been resolved in a recent patch commit, 7acf3df, following responsible disclosure by security researcher Tristan Madani.

Critical libssh2 Vulnerability

The vulnerability is classified as CWE-680, an integer overflow that leads to a buffer overflow. Specifically, the flaw exists in the `ssh2_transport_read()` function within `transport.c`. Here, insufficient validation of the `packet_length` field allows attackers to trigger an out-of-bounds write.

The function fails to enforce proper upper limits on incoming packet sizes, enabling malicious actors to provide excessively large values that exceed allocated memory limits.

In practical exploitation scenarios, a remote attacker can connect to a vulnerable application using libssh2 and send a malformed SSH packet with a manipulated `packet_length` field.

Due to the lack of boundary checks, the library allocates insufficient memory and then writes beyond the allocated buffer. This results in heap corruption, allowing the attacker to overwrite adjacent memory structures and gain arbitrary code execution within the context of the affected application.

Given the network-based attack vector and the absence of authentication requirements, this vulnerability significantly increases the risk for exposed systems.

The CVSS v4 vector indicates low attack complexity and no user interaction, making exploitation straightforward, especially in environments where libssh2 is integrated into automated services, embedded systems, or backend infrastructures that handle SSH communications.

Security researchers have noted that libssh2 is commonly embedded in various tools, including file transfer utilities, automation frameworks, and custom SSH clients.

This broad usage increases the potential attack surface, particularly in enterprise environments where the library may be statically linked and not easily identifiable through standard package management tools. Consequently, organizations may unknowingly run vulnerable instances, even if their primary systems appear up to date.

The maintainers have released a patch that addresses the improper validation logic by introducing strict bounds checking on the `packet_length` field before memory allocation and processing.

Developers are strongly advised to update to the patched version or apply the fix from the official GitHub repository. The relevant pull request and commit provide insight into the code changes that mitigate the issue.

Until patches are applied, mitigation strategies include restricting SSH access to trusted hosts, implementing network-level filtering, and monitoring for unusual SSH traffic patterns that may indicate exploitation attempts. Indicators may include unusually large SSH packets or unexpected application crashes linked to libssh2.

This vulnerability underscores the ongoing risks posed by memory safety issues in widely used libraries. It reinforces the need for rigorous input validation in network protocol implementations.

Organizations relying on libssh2 should prioritize patching efforts and conduct thorough dependency audits to identify and remediate vulnerable instances across their environments.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.