Public PoC Released for Critical libssh2 CVE-2026-55200 Client-Side SSH Flaw

A public proof-of-concept (PoC) has been released for CVE-2026-55200, a critical vulnerability in the libssh2 client-side SSH library. The flaw, with a CVSS 4.0 score of 9.2, allows a malicious or compromised SSH server to trigger memory corruption on a connecting client, potentially leading to remote code execution without requiring credentials or user interaction.

The vulnerability resides in the ssh2_transport_read() function in transport.c, which parses incoming SSH packets during the handshake. The function fails to enforce an upper bound on the attacker-controlled packet_length field, leading to an integer overflow (CWE-680) that results in a heap buffer overflow. This is similar to a previously patched flaw (CVE-2019-3855) from 2019.

libssh2 is embedded in numerous applications, including curl, Git, PHP, backup agents, and firmware updaters. Many of these copies are statically linked, meaning standard package updates may not address them. The bug affects all libssh2 releases up to and including version 1.11.1.

Security researcher Tristan Madani reported the issue, and maintainers merged the patch via pull request #2052 on June 12. VulnCheck published the CVE on June 17. The PoC, published in the “exploitarium” GitHub archive, includes a locally verified SSH trigger scaffold and a controlled local RCE harness, but not a turnkey remote exploit. As of now, CISA’s exploitation rating is “none,” and no in-the-wild exploitation has been reported.

There is no official fixed libssh2 release yet; the patch is in the mainline source. Linux distributions and downstream projects are backporting it. NHS England Digital has issued an advisory urging affected organizations to update. Organizations should inventory all instances of libssh2, including statically linked copies, and apply builds that include commit 97acf3d. Until patched, restrict outbound SSH connections to trusted servers and verify host keys. Also, patch related vulnerabilities CVE-2026-55199 (CVSS 8.2) and CVE-2025-15661 (CVSS 8.3).