Critical libssh2 Vulnerability Lets Remote Attackers Execute Code via Crafted SSH Packets

Gbhackers •Divya • June 23, 2026

A critical security vulnerability has been identified in libssh2, a widely used client-side SSH library. This flaw allows remote attackers to execute code by sending specially crafted SSH packets. The vulnerability, tracked as CVE-2026-55200, has a CVSS score of 9.2 and affects libssh2 versions up to and including 1.11.1. The issue has been resolved in […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in libssh2 Enable Remote Code Execution and DoS Attacks Two critical vulnerabilities have been discovered in libssh2, a widely used SSH library, affecting versions up to 1.11.1. The first vulnerability, CVE-2026-55200, allows remote code execution through crafted SSH packets, with a CVSS score of 9.2. The second vulnerability, CVE-2026-55199, enables denial-of-service attacks by causing client CPU exhaustion. Both vulnerabilities can be exploited without user interaction or authentication, posing a significant risk to systems using libssh2 for remote management. Patches are available in the form of GitHub commits, but a new official release has not yet been issued. The vulnerabilities could impact millions of systems globally, including routers, IoT devices, and servers. As of now, there are no reports of active exploitation. 19 sources 68

Extracted Entities

CVEs (1)

CVE-2026-55200

Vulnerabilities (1)

Libssh2 Vulnerability