libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport

libssh2's ssh2_transport_read() in transport.c reads the 4-byte packet_length field straight off the wire and uses it to size buffers and drive copy logic without an upper-bound check. A malicious peer supplies a huge value, an integer math step wraps, and the library performs an out-of-bounds heap write during the very first transport negotiation — *before* key exchange, *before* authentication, *before* the user types anything. This is a classic CWE-680 (integer overflow to buffer overflow) primitive, and with the right heap shaping it gives remote code execution in the process embedding libssh2. All versions through 1.11.1 are affected; the fix landed in upstream commit 7acf3df.

The vendor's CRITICAL/9.2 rating is honest for the *primitive* — pre-auth, network-reachable memory corruption is exactly what 9.x is supposed to mean. What the CVSS doesn't show is the direction of the arrow: libssh2 is overwhelmingly used as a client library (curl --ssh, PHP's ssh2 extension, libgit2 SSH transport, some backup agents, embedded device management clients), so the victim has to initiate the connection — to either an attacker-controlled SSH server or an on-path attacker who can intercept TCP/22. That's why we hold this at HIGH (8.2) instead of CRITICAL: the bug is real, the impact is real, but the *trigger* requires the attacker to be on the path or to lure the client. Reliability is also non-trivial — the CVSS 4.0 vector explicitly carries AT:P, meaning heap-layout conditions must hold for code execution.

Why this verdict

• Client-side trigger, not server-side: libssh2 listens for nothing; the victim must initiate the SSH session. That removes the "internet-wide spray" failure mode that defines true CRITICAL network bugs like Log4Shell or BlueKeep.
• AT:P is real: CVSS 4.0 explicitly flags attack requirements. Crashing the client is trivial; achieving RCE requires per-target heap grooming against modern allocators with ASLR.
• No PoC, no KEV, EPSS 0.55%: none of the three independent exploitation indicators is firing. Vendor 9.2 reflects the primitive's theoretical ceiling, not the realistic near-term threat.
• Role multiplier — CI/CD and build agents: Jenkins/GitLab runners using libgit2+libssh2 to clone from SSH remotes are a canonical supply-chain pivot. A poisoned mirror or hijacked DNS for git.internal lands code execution on the builder, which then signs and publishes artifacts. This is why the floor is HIGH, not MEDIUM.
• Role multiplier — backup and replication agents: Veeam-style agents, rsync-over-ssh wrappers, and storage replication tools that embed libssh2 typically run as root/SYSTEM and connect to many endpoints. Any one compromised remote pops the backup tier — fleet-scale blast radius.
• Role multiplier — PHP ssh2 extension on web tier: if a web app calls ssh2_connect() against attacker-controllable hostnames (SSRF-adjacent feature), the web process pops. Narrow but real.

Why not higher?

CRITICAL is reserved for bugs an attacker can ring without invitation — listening services, browser drive-bys, or active mass scanning. This bug requires either victim-initiated connection to a hostile endpoint or on-path interception, neither of which scales like a wormable server-side flaw. No public exploit and EPSS under 1% confirm we are not yet in fire-drill territory.

Why not lower?

MEDIUM would be wrong because the bug is pre-authentication memory corruption in a library shipped in *thousands* of distinct products, including high-value-role components (build agents, backup tooling). A single supply-chain compromise of a popular git mirror combined with this CVE compromises every CI runner that clones it. That blast radius floors the verdict at HIGH per noisgate role-multiplier rules.

1. Inventory every libssh2 consumer via SBOM — You cannot scan for this — libssh2 doesn't listen. Pull from package managers (dpkg -l libssh2-1, rpm -qa | grep libssh2, apk info libssh2), language ecosystems (PHP pecl list, Python packages bundling it, Node native modules), and container image SBOMs (Syft/Grype). Complete within 7 days under the HIGH noisgate mitigation SLA (≤ 30 days).
2. Restrict outbound SSH to allowlisted endpoints — Force all egress SSH through known jump hosts or a managed proxy. Block direct port-22 egress from CI runners, web tiers, and backup agents to anywhere outside the allowlist. Deploy within the noisgate mitigation SLA of 30 days — this neutralizes the malicious-server vector for managed networks.
3. Pin git/clone sources to verified internal mirrors — Build pipelines must clone only from your internal artifact registry or mirrored Git server, never from arbitrary upstream URLs. This breaks the supply-chain attack path even if libssh2 is unpatched on the runner.
4. Enable verbose known_hosts checking and pin host keys — Strict host-key checking ensures an on-path MitM presenting a different SSH server key terminates the connection before ssh2_transport_read() is called against attacker bytes. Configure StrictHostKeyChecking=yes and pre-seed known_hosts.
5. Rebuild and ship downstream consumers — Patching libssh2 the package is not enough if you ship containers or appliances that statically link or bundle older builds. Rebuild every internal image whose SBOM lists libssh2 ≤ 1.11.1 and push within the noisgate remediation SLA of 180 days.

Run this on each Linux/macOS host suspected of using libssh2 — including build runners, web servers, backup agents. Invoke as sudo ./check_libssh2.sh (root required to read all linked binaries). It enumerates package versions, ldconfig entries, and statically embedded copies, then prints VULNERABLE / PATCHED / UNKNOWN.

#!/usr/bin/env bash
# noisgate: CVE-2026-55200 libssh2 OOB write verifier
# Exit codes: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN
set -u
FIXED_VER="1.11.2"   # first release expected to carry commit 7acf3df
VULN=0
FOUND=0

compare_ver() {
  # returns 0 if $1 >= $2
  [ "$(printf '%s\n%s\n' "$2" "$1" | sort -V | head -n1)" = "$2" ]
}

echo "[*] Checking package manager records..."
if command -v dpkg >/dev/null 2>&1; then
  while read -r name ver; do
    [ -z "$name" ] && continue
    FOUND=1
    clean=$(echo "$ver" | sed 's/[-+].*//')
    if compare_ver "$clean" "$FIXED_VER"; then
      echo "  [OK]  dpkg $name $ver"
    else
      echo "  [!!]  dpkg $name $ver  <- below $FIXED_VER"
      VULN=1
    fi
  done < <(dpkg-query -W -f='${Package} ${Version}\n' 2>/dev/null | grep -E '^libssh2')
fi

if command -v rpm >/dev/null 2>&1; then
  while read -r line; do
    [ -z "$line" ] && continue
    FOUND=1
    name=$(echo "$line" | awk '{print $1}')
    ver=$(echo "$line" | awk '{print $2}')
    if compare_ver "$ver" "$FIXED_VER"; then
      echo "  [OK]  rpm $name $ver"
    else
      echo "  [!!]  rpm $name $ver  <- below $FIXED_VER (check distro backport)"
      VULN=1
    fi
  done < <(rpm -qa --qf '%{NAME} %{VERSION}\n' 2>/dev/null | grep -E '^libssh2')
fi

if command -v apk >/dev/null 2>&1; then
  while read -r line; do
    [ -z "$line" ] && continue
    FOUND=1
    pkg=$(echo "$line" | sed 's/-[0-9].*//')
    ver=$(echo "$line" | sed "s/^${pkg}-//")
    if compare_ver "$ver" "$FIXED_VER"; then
      echo "  [OK]  apk $pkg $ver"
    else
      echo "  [!!]  apk $pkg $ver"
      VULN=1
    fi
  done < <(apk info -v 2>/dev/null | grep -E '^libssh2')
fi

echo "[*] Scanning linked shared objects..."
for so in $(find /usr /opt /app -name 'libssh2.so*' 2>/dev/null); do
  FOUND=1
  ver=$(strings "$so" 2>/dev/null | grep -oE 'libssh2/[0-9]+\.[0-9]+\.[0-9]+' | head -n1 | sed 's|libssh2/||')
  if [ -z "$ver" ]; then
    echo "  [??]  $so (no embedded version string)"
    continue
  fi
  if compare_ver "$ver" "$FIXED_VER"; then
    echo "  [OK]  $so -> $ver"
  else
    echo "  [!!]  $so -> $ver"
    VULN=1
  fi
done

echo "[*] Hunting for statically linked copies in common binaries..."
for b in $(command -v curl git php node python3 2>/dev/null); do
  if strings "$b" 2>/dev/null | grep -q 'libssh2/'; then
    FOUND=1
    sver=$(strings "$b" | grep -oE 'libssh2/[0-9]+\.[0-9]+\.[0-9]+' | head -n1 | sed 's|libssh2/||')
    if [ -n "$sver" ] && compare_ver "$sver" "$FIXED_VER"; then
      echo "  [OK]  $b statically embeds libssh2 $sver"
    else
      echo "  [!!]  $b statically embeds libssh2 ${sver:-unknown}"
      VULN=1
    fi
  fi
done

if [ "$FOUND" -eq 0 ]; then
  echo "RESULT: UNKNOWN (no libssh2 evidence found on this host)"
  exit 2
fi
if [ "$VULN" -eq 1 ]; then
  echo "RESULT: VULNERABLE"
  exit 1
fi
echo "RESULT: PATCHED"
exit 0

Sources

1. GitHub Security Advisory GHSA-r8mh-x5qv-7gg2
2. VulnCheck advisory
3. OpenCVE CVE-2026-55200
4. CVEFeed CVE-2026-55200
5. Positive Technologies dbugs writeup
6. Cybersecurity News coverage
7. GBHackers analysis
8. libssh2 upstream repository