PoC for libssh2 CVE-2026-55200 — critical SSH client vulnerability

Colleagues, a PoC for CVE-2026-55200 in libssh2 has been published.

Briefly:
- The vulnerability lets a server trigger memory corruption on the client and potentially execute code without credentials; affects versions up to 1.11.1 (CVSS 9.2).
- libssh2 is embedded in curl, Git, PHP, backup agents and firmware; many builds are statically linked and will not update automatically.
- A patch (commit 97acf3d) has been merged; a PoC is available in exploitarium. No confirmed mass exploitation yet, but the risk is real.

Why this matters: a client-side bug can affect unexpected services—inventory and update embedded copies.

How do you check embedded/static libssh2 builds?

#cybersecurity #SSH #libssh2 #vulnerabilities