PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-55199 libssh2 CVE debrief

CVE-2026-55199 is a high-severity pre-authentication denial of service vulnerability in libssh2, allowing a malicious SSH server to cause a client CPU exhaustion loop. The vulnerability is triggered by a crafted extension count value in the SSH_MSG_EXT_INFO handler. A malicious server can set nr_extensions to 0xFFFFFFFF during key exchange, causing the client to spin in a tight CPU loop for over 60 seconds. This issue was fixed in commit 1762685. Organizations using libssh2 should update to the latest version to mitigate this vulnerability.

Vendor
libssh2
Product
libssh2
CVSS
HIGH 8.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-17
Original CVE updated
2026-06-22
Advisory published
2026-06-17
Advisory updated
2026-06-22

Who should care

Developers and administrators using libssh2 for SSH functionality in their applications or infrastructure should prioritize updating to the latest version to prevent potential denial of service attacks.

Technical summary

The vulnerability exists in the SSH_MSG_EXT_INFO handler in src/packet.c of libssh2 through version 1.11.1. A malicious SSH server can cause a client CPU exhaustion loop by sending a crafted extension count value. Specifically, setting nr_extensions to 0xFFFFFFFF during key exchange leads to an unchecked return value from _libssh2_get_string(), causing the client to enter a CPU-bound loop. The session timeout does not apply to such loops, leading to a prolonged denial of service.

Defensive priority

high

Recommended defensive actions

  • Update libssh2 to the latest version (post-commit 1762685) to patch the vulnerability.
  • Implement network monitoring to detect and block suspicious SSH traffic.
  • Enforce strict SSH server authentication and access controls.
  • Limit SSH server exposure to trusted networks and IPs.
  • Regularly review and update SSH configurations and dependencies.
  • Consider implementing rate limiting for SSH connections.

Evidence notes

The CVE and NVD records provide details on the vulnerability, including its CVSS score and references to the fix and disclosure information. The CVE was published on 2026-06-17 and modified on 2026-06-18.

Official resources

public