Description
libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.
Published: 2026-06-17
Score: 9.2 Critical
EPSS: 3.9% Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

Libssh2 1.11.1 contains an out‑of‑bounds write that can corrupt heap memory and allow remote code execution. The flaw arises because the library does not check that the packet_length field in an SSH packet is bounded before copying data into a buffer. An attacker can send a packet with a maliciously large packet_length, triggering heap corruption that ultimately can be used to execute arbitrary code. The vulnerability is categorized as CWE‑680.

Affected Systems

The vulnerability affects the libssh2 library, specifically the 1.11.1 release which has not yet incorporated the patch in commit 97acf3df. Any application that links against this library and accepts SSH traffic is potentially exposed. The CPE list includes the base CPE for libssh2 and the specific 1.11.1 CPE. No additional affected product or version information is provided, so an assessment of earlier releases cannot be made from the available data.

Risk and Exploitability

The CVSS score of 9.2 rates this flaw as critical, reflecting threat to confidentiality, integrity, and availability. The EPSS score of 4 % indicates a non‑zero probability that exploitation may occur in the wild, but it does not guarantee widespread exploitation. The vulnerability is not yet listed in the CISA KEV catalog. An attacker can remotely trigger the flaw by sending a malicious SSH packet over a connection that the victim processes with the vulnerable library. Therefore, the risk is high for any exposed service that uses libssh2 1.11.1 until it is upgraded or mitigated.

Generated by OpenCVE AI on October 23, 2026 at 08:00 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade libssh2 to a version that incorporates the fix from commit 97acf3df or later; this patch restores proper bounds checking on packet_length before copying data into memory.
  • Restrict inbound SSH traffic to trusted networks or hosts using firewall or ACL rules, thereby reducing the attack surface for potential exploitation.
  • Continuously monitor SSH logs for unusual packet sizes or connection attempts that deviate from normal operation, as such anomalies could indicate an attempt to exercise the vulnerability.

Generated by OpenCVE AI on October 23, 2026 at 08:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6365-1 libssh2 security update
Ubuntu USN Ubuntu USN USN-8486-1 libssh2 vulnerabilities
History

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Description libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution. libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.

Thu, 17 Sep 2026 17:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:libssh2:libssh2:1.11.1:*:*:*:*:*:*:*

Tue, 30 Jun 2026 13:30:00 +0000

Type Values Removed Values Added
References

Wed, 24 Jun 2026 16:30:00 +0000

Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 24 Jun 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Thu, 18 Jun 2026 04:45:00 +0000

Type Values Removed Values Added
Description libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.
Title libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c
First Time appeared Libssh2
Libssh2 libssh2
Weaknesses CWE-680
CPEs cpe:2.3:a:libssh2:libssh2:*:*:*:*:*:*:*:*
Vendors & Products Libssh2
Libssh2 libssh2
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Subscriptions

Libssh2 Libssh2
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-11-08T14:05:21.714Z

Reserved: 2026-06-16T15:53:37.764Z

Link: CVE-2026-55200

cve-icon Vulnrichment

Updated: 2026-06-17T19:45:05.382Z

cve-icon NVD

Status : Modified

Published: 2026-06-17T20:17:28.667

Modified: 2026-10-22T19:17:55.937

Link: CVE-2026-55200

cve-icon Redhat

Severity : Important

Publid Date: 2026-06-17T19:03:15Z

Links: CVE-2026-55200 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T08:00:17Z

Weaknesses
  • CWE-680

    Integer Overflow to Buffer Overflow