By vendor

Libssh2 vulnerabilities

Known CVEs affecting Libssh2 products, prioritized by severity, with SEC.co remediation and detection guidance.

5 published vulnerabilities

• CVE-2026-55200HIGH 8.1

  libssh2 versions up to 1.11.1 contain a flaw that allows attackers to send malformed SSH packets over the network. The vulnerability fails to properly validate the size field in incoming packets, allowing an attacker to write data beyond the allocated memory buffer. This memory corruption can be leveraged to execute arbitrary code on systems running vulnerable versions. No authentication is required; an attacker anywhere on the network can trigger this vulnerability.

• CVE-2026-58050HIGH 7.0

  libssh2, a widely used SSH client library, contains a heap buffer overflow vulnerability affecting versions through 1.11.1. When a libssh2 client connects to an SSH server, the library parses responses from the public-key subsystem. An attacker operating a malicious SSH server can craft a response with a specially crafted attribute count that causes integer overflow during memory allocation on 32-bit platforms, resulting in a smaller buffer than intended. The library then writes attribute data beyond the allocated buffer boundary, corrupting heap memory and potentially enabling code execution or denial of service.

• CVE-2025-15661MEDIUM 6.5

  libssh2 versions up to 1.11.1 contain a flaw in how they handle responses from SSH servers during SFTP file operations. A malicious or compromised SSH server can craft a specially-malformed response that causes the client library to read beyond the boundaries of its own memory buffer. This can leak sensitive data from the application's memory or cause the client to crash. The vulnerability exists in the symlink-related operations (READLINK and REALPATH) and requires network access to an SSH server, but does not require user interaction or special privileges.

• CVE-2026-58051MEDIUM 6.5

  libssh2, a widely-used SSH protocol library, contains a memory safety bug affecting versions through 1.11.1. When a malicious SSH server sends a crafted response during publickey subsystem negotiation, libssh2 can fail to properly initialize new entries in its public key list. If parsing then fails, the cleanup routine attempts to free memory that was never initialized, potentially executing arbitrary code or causing a denial of service. An attacker controlling an SSH server can trigger this condition without any special privileges or user interaction.

• CVE-2026-55199MEDIUM 5.9

  libssh2 versions through 1.11.1 contain a vulnerability that allows a malicious SSH server to exhaust CPU resources on a connecting client. During the SSH handshake, an attacker can send specially crafted data that causes the client library to enter an intense processing loop lasting over 60 seconds, effectively freezing the application. This occurs because the library doesn't properly validate server responses and timeout protections don't apply to CPU-intensive operations. The attacker must control the SSH server being connected to, which limits exposure but is significant for organizations connecting to untrusted or compromised servers.