Pre-authentication Denial of Service in libssh2 via Malicious SSH Server

CVE-2026-55199

What is CVE-2026-55199?

libssh2 versions prior to 1.11.1 are susceptible to a pre-authentication denial of service vulnerability. A malicious SSH server can exploit this by sending crafted extension count values during the key exchange process, specifically manipulating the 'nr_extensions' variable to an excessively high value (0xFFFFFFFF). This results in the client entering a CPU exhaustion loop, where it remains overly occupied for extended periods without responding. The issue stems from unchecked return values from the _libssh2_get_string() function, which leads to undetectable resource consumption during normal operations, posing a significant risk to operational stability.

References