PT-2026-50527 · Libssh2 · Libssh2

Tristan Madani · Published 2026-06-17 · Updated 2026-06-17 · CVE-2026-55199

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libssh2 versions prior to 1.11.1

Description A pre-authentication denial of service issue exists in the SSH MSG EXT INFO handler within src/packet.c. A malicious SSH server can trigger a CPU exhaustion loop on the client by sending a crafted extension count value. Specifically, by setting nr extensions to 0xFFFFFFFF during key exchange, the client enters a tight CPU loop for over 60 seconds because return values from the libssh2 get string() function are unchecked and session timeouts do not apply to CPU-bound loops.

Recommendations Update to the version containing commit 1762685.

Fix

DoS

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2026-55199

Affected Products

Libssh2

References · 5

• https://github.com/libssh2/libssh2/commit/17626857d20b3c9a1addfa45979dadcee1cd84a4 · Patch
• https://github.com/libssh2/libssh2/pull/1864 · Note
• https://twitter.com/VulmonFeeds/status/2067386658618491135 · Twitter Post
• https://twitter.com/CVEnew/status/2067350987346526672 · Twitter Post
• https://vulncheck.com/advisories/libssh2-pre-authentication-dos-via-ssh-msg-ext-info-handler · Note