CVE Feed

    Dashboard / CVE / CVE-2026-55200

    CVE-2026-55200

    libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.

    Published:Jun 17, 2026
    Last Modified:Jun 30, 2026
    EPS:Jun 17, 2026
    EPSS Score:0.00922
    CVSS Score:8.1

    Affected Products

    Vendor
    Libssh2
    Product
    Libssh2

    Exploits

    https://web.archive.org/web/20260623211210/https://github.com/bikini/exploitarium/tree/main/libssh2-cve-2026-55200-pochttps://github.com/0xBlackash/CVE-2026-55200https://github.com/kaleth4/CVE-2026-55200https://github.com/xd20111/CVE-2026-55200

    Related CVEs

    CVE-2026-66035 (CVSS 7.7) — libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerabil…
    CVE-2026-66034 (CVSS 7.7) — libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a m…
    CVE-2026-66033 (CVSS 8.7) — libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability…
    CVE-2026-66032 (CVSS 8.7) — libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() funct…
    CVE-2026-58051 (CVSS 8.3) — libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries bef…
    CVE-2026-58050 (CVSS 8.3) — libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response…
    CVE-2025-15661 (CVSS 8.3) — libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp…
    CVE-2026-55199 (CVSS 8.2) — libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability…
    CVE-2026-7598 (CVSS 6.9) — A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function usera…
    CVE-2023-48795 (CVSS 5.9) — The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, al…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High