A critical bug in the widely used libssh2 SSH client library could let a hostile SSH server compromise computers and devices that connect to it. Arctic Wolf says CVE-2026-55200 is a pre-authentication memory-corruption flaw in ssh2_transport_read() affecting libssh2 1.11.1 and earlier, triggered by a crafted packet_length value; public proof-of-concept code is available, an upstream patch has been merged but no formal tagged release was available at publication, and many downstream tools may be hard to patch because they statically embed the library.
Why it matters: This is urgent because affected software can be exposed just by connecting to a malicious or compromised SSH server, with no credentials or user interaction required. Organizations should inventory anything that uses libssh2, apply source or downstream patches, and restrict outbound SSH connections to trusted hosts until fixes are in place.
Arctic Wolf Labs
2026.06.30
100% relevant
This article appears to be the initial trackable report here of CVE-2026-55200 in libssh2, including the core technical details, affected versions, patch status, and practical mitigation guidance.
← Back to all stories