Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-55200: libssh2 library update prevents remote code execution
CVE-2026-55200 · published today
Summary
The libssh2 software used in several Linux distributions has a security hole that could let an attacker run malicious code on your server. Updating libssh2 to the latest version provided by your operating system's package manager fixes the issue. Apply the recommended updates as soon as possible.
What to do
- Update alpine libssh2 to version 1.11.1-r2.
- Update alpine libssh2 to version 1.11.1-r3.
- Update bellsoft libssh2 to version 1.11.1-r2.
- Update bellsoft libssh2 to version 1.11.1-r3.
- Update debian rootio-libssh2 to version 1.10.0-3.root.io.2.
- Update canonical libssh2 to version 1.11.1-1ubuntu0.25.10.2.
- Update canonical libssh2 to version 1.11.1-1ubuntu0.26.04.2.
- Update debian rootio-libssh2 to version 1.9.0-2+deb11u1.root.io.2.
- Update debian libssh2 to version 1.11.1-1+deb13u1.
- Update debian libssh2 to version 1.11.1-4.
- Update debian libssh2 to version 1.10.0-3.aikido.7.
- Update alpine rust to version 1.96.1-r0.
- Update debian libssh2 to version 1.9.0-2+deb11u1.root.io.3.
- Update debian rootio-libssh2 to version 1.9.0-2+deb11u1.root.io.3.
- Update debian rootio-libssh2 to version 1.10.0-3.aikido.7.
- Update libssh2 to version 1.11.1-r2.
- Update libssh2 to version 1.11.1-r3.
- Update rust to version 1.96.1-r0.
- Update libssh2 to version 1.9.0-2+deb11u1.aikido.6.
- Update rootio-libssh2 to version 1.9.0-2+deb11u1.aikido.6.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:11 | debian | libssh2 | All versions |
| Debian:12 | debian | libssh2 | All versions |
| Debian:13 | debian | libssh2 |
< 1.11.1-1+deb13u1 Fix: upgrade to 1.11.1-1+deb13u1
|
| Debian:14 | debian | libssh2 |
< 1.11.1-4 Fix: upgrade to 1.11.1-4
|
| Ubuntu:Pro:14.04:LTS | canonical | libssh2 | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | libssh2 | All versions |
| Ubuntu:18.04:LTS | canonical | libssh2 | All versions |
| Ubuntu:20.04:LTS | canonical | libssh2 | All versions |
| Ubuntu:22.04:LTS | canonical | libssh2 | All versions |
| Ubuntu:24.04:LTS | canonical | libssh2 | All versions |
| Ubuntu:25.10 | canonical | libssh2 |
< 1.11.1-1ubuntu0.25.10.2 Fix: upgrade to 1.11.1-1ubuntu0.25.10.2
|
| Ubuntu:26.04:LTS | canonical | libssh2 |
< 1.11.1-1ubuntu0.26.04.2 Fix: upgrade to 1.11.1-1ubuntu0.26.04.2
|
| Alpine:v3.22 | alpine | libssh2 |
< 1.11.1-r2 Fix: upgrade to 1.11.1-r2
|
| Alpine:v3.23 | alpine | libssh2 |
< 1.11.1-r3 Fix: upgrade to 1.11.1-r3
|
| Alpine:v3.24 | alpine | libssh2 |
< 1.11.1-r3 Fix: upgrade to 1.11.1-r3
|
| – | libssh2 | libssh2 |
<= 1.11.1 1.11.1 cpe:2.3:a:libssh2:libssh2:*:*:*:*:*:*:*:* |
| Alpaquita:25 | bellsoft | libssh2 |
>= 1.11.1-r0, < 1.11.1-r2 Fix: upgrade to 1.11.1-r2
|
| Alpaquita:stream | bellsoft | libssh2 |
>= 1.10.0-r4, < 1.11.1-r3 Fix: upgrade to 1.11.1-r3
|
| Root:Debian:12 | debian | rootio-libssh2 |
< 1.10.0-3.root.io.2 < 1.10.0-3.aikido.7 Fix: upgrade to 1.10.0-3.root.io.2
|
| Root:Debian:11 | debian | rootio-libssh2 |
< 1.9.0-2+deb11u1.root.io.2 < 1.9.0-2+deb11u1.root.io.3 Fix: upgrade to 1.9.0-2+deb11u1.root.io.2
|
| Root:Debian:12 | debian | libssh2 |
< 1.10.0-3.aikido.7 Fix: upgrade to 1.10.0-3.aikido.7
|
| Alpine:v3.21 | alpine | libssh2 |
< 1.11.1-r2 Fix: upgrade to 1.11.1-r2
|
| Alpine:v3.24 | alpine | rust |
< 1.96.1-r0 Fix: upgrade to 1.96.1-r0
|
| Root:Debian:11 | debian | libssh2 |
< 1.9.0-2+deb11u1.root.io.3 Fix: upgrade to 1.9.0-2+deb11u1.root.io.3
|
| Alpine:v3.21 | – | libssh2 |
< 1.11.1-r2 Fix: upgrade to 1.11.1-r2
|
| Alpine:v3.23 | – | libssh2 |
< 1.11.1-r3 Fix: upgrade to 1.11.1-r3
|
| Alpine:v3.24 | – | rust |
< 1.96.1-r0 Fix: upgrade to 1.96.1-r0
|
| Root:Debian:11 | – | libssh2 |
< 1.9.0-2+deb11u1.aikido.6 Fix: upgrade to 1.9.0-2+deb11u1.aikido.6
|
| Root:Debian:11 | – | rootio-libssh2 |
< 1.9.0-2+deb11u1.aikido.6 Fix: upgrade to 1.9.0-2+deb11u1.aikido.6
|
Original advisory text
CVE-2026-55200 in libssh2 - Patched by Root
Root has patched CVE-2026-55200 in the libssh2 package for Root:Debian:11. Multiple fixed versions available.
References
- https://docs.bell-sw.com/security/cves/CVE-2026-55200 Vendor Advisory
- https://github.com/bikini/exploitarium/tree/main/libssh2-cve-2026-55200-poc Patch
- https://security-tracker.debian.org/tracker/CVE-2026-55200 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55200... Vendor Advisory
- https://github.com/libssh2/libssh2 Product
- https://nvd.nist.gov/vuln/detail/CVE-2026-55200 Vendor Advisory
- https://web.archive.org/web/20260623211210/https://github.com/bikini/exploitariu... Exploit
- https://github.com/libssh2/libssh2/commit/97acf3dfda80c91c3a8c9f2372546301d4a1a7... patch
- https://security.alpinelinux.org/vuln/CVE-2026-55200 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-55200 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-55200 Third Party Advisory
- https://ubuntu.com/security/notices/USN-8486-1 Vendor Advisory
- https://github.com/libssh2/libssh2/pull/2052 issue-tracking patch
- https://www.vulncheck.com/advisories/libssh2-out-of-bounds-write-via-unchecked-p... third-party-advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-680Integer Overflow to Buffer Overflow
Timeline
Published12 Nov 2026
Updated12 Nov 2026
First seen17 Jun 2026
Sources
DEBIAN-CVE-2026-55200 · OSV
UBUNTU-CVE-2026-55200 · OSV
ALPINE-CVE-2026-55200 · OSV
BELL-CVE-2026-55200 · OSV
CVE-2026-55200 · NVD
CVE-2026-55200 · MITRE
CVE-2026-55200 · OSV
Track software like this
Free during beta