CVE-2026-55199
Received Received - Intake
libssh2 Pre-Authentication Denial of Service via Malicious SSH Server

Publication date: 2026-06-17

Last updated on: 2026-06-17

Assigner: VulnCheck

Description
libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can set nr_extensions to 0xFFFFFFFF during key exchange, causing the client to spin in a tight CPU loop for over 60 seconds because return values from _libssh2_get_string() are unchecked and the session timeout does not apply to CPU-bound loops.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-17
Last Modified
2026-06-17
Generated
2026-06-18
AI Q&A
2026-06-18
EPSS Evaluated
N/A
NVD
CVE-2026-55199
EUVD
EUVD-2026-37782
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
libssh2 libssh2 to 1.11.1 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-835 The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in libssh2 versions through 1.11.1 and involves a pre-authentication denial of service issue in the SSH_MSG_EXT_INFO handler located in src/packet.c.

A malicious SSH server can exploit this by sending a specially crafted extension count value (nr_extensions set to 0xFFFFFFFF) during the key exchange process.

Because the client does not properly check return values from the _libssh2_get_string() function and the session timeout does not apply to CPU-bound loops, the client enters a tight CPU exhaustion loop lasting over 60 seconds.

Impact Analysis

This vulnerability can cause a denial of service condition on the client side by exhausting the CPU resources.

When connecting to a malicious SSH server, the client may become unresponsive or significantly slowed down for over a minute due to the CPU spinning in a tight loop.

This can disrupt normal operations, potentially causing delays or failures in automated processes or user activities relying on SSH connections.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55199. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart