Executive brief
libssh2 is a widely used library that allows applications to communicate securely using the SSH protocol. A vulnerability in how the library handles initial connection messages allows a malicious server to force a client application into an unresponsive state. This results in a denial of service where the client consumes excessive processor power for over a minute, potentially crashing the application or disrupting automated tasks.
Technical details
A denial of service vulnerability exists in the SSH_MSG_EXT_INFO handler within src/packet.c of libssh2. The root cause is a failure to check the return values of _libssh2_get_string() when parsing extension name/value pairs. An attacker-controlled SSH server can send a crafted extension count (nr_extensions) of 0xFFFFFFFF; if the buffer is exhausted, the client enters a tight CPU loop performing no-op iterations. Because session timeouts do not apply to these CPU-bound loops, the client remains unresponsive for a significant duration. The issue is fixed in commit 1762685 by ensuring the loop breaks upon parsing failures.
Affected products
- libssh2 libssh2 through 1.11.1
Timeline
- 2026-04-15: disclosed: Initial pull request submitted by researcher
- 2026-04-21: patched: Fix merged into master branch via commit 1762685
- 2026-06-17: advisory: CVE-2026-55199 published