CVE-2026-55199: falha de alta gravidade em libssh2
libssh2 - Pre-Authentication DoS via SSH_MSG_EXT_INFO Handler
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.2epss 0.9%
libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can set nr_extensions to 0xFFFFFFFF during key exchange, causing the client to spin in a tight CPU loop for over 60 seconds because return values from _libssh2_get_string() are unchecked and the session timeout does not apply to CPU-bound loops.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
libssh2 · libssh2CVEs relacionadas — libssh2
No mesmo produto, das mais perigosas para as menos.
CVE-2026-55200CRITICALlibssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.cEPSS 3.9%CVE-2025-15661HIGHlibssh2 - Heap Buffer Over-read via sftp_symlink() in sftp.cEPSS 0.6%CVE-2026-66033HIGHlibssh2 Integer Underflow DoS via AES-GCM Cipher NegotiationEPSS 0.6%CVE-2026-66035HIGHlibssh2 Heap Buffer Overflow via ETM Cipher NegotiationEPSS 0.5%CVE-2026-66032HIGHlibssh2 Double-Free Heap Corruption via sftp_open()EPSS 0.4%CVE-2026-58050HIGHlibssh2 - Integer Overflow in publickey Subsystem Attribute AllocationEPSS 0.4%