PoC Exploit Published for Critical libssh2 Flaw Embedded in curl, Git, and PHP

Security researchers have published a working proof-of-concept exploit for CVE-2026-55200, a critical memory corruption vulnerability in libssh2 rated CVSS 9.2 that affects every version of the widely deployed SSH library up to and including 1.11.1.

libssh2 is not a standalone product most developers think about directly — it is a dependency embedded silently inside curl, Git, PHP, backup agents, firmware updaters, and a long tail of network appliances. That reach makes CVE-2026-55200 unusually dangerous: exploiting the flaw does not require a victim to run SSH server software, only to make an outbound SSH connection to a malicious or attacker-controlled host.

How the Vulnerability Works

The bug lives in ssh2_transport_read() in transport.c, the function responsible for parsing incoming SSH packets during the connection handshake. An attacker-controlled packet_length field is not validated against an upper bound before being used in an arithmetic expression that calculates the heap allocation size for decrypted packets.

The result: a 32-bit integer overflow produces an undersized heap allocation, followed by out-of-bounds writes into adjacent memory — a classic heap corruption primitive that can be escalated to remote code execution depending on the target binary, allocator behavior, and enabled mitigations.

PoC Details and Exploit Maturity

The proof-of-concept was published in the "exploitarium" GitHub archive. It includes a locally verified SSH trigger scaffold and a controlled local RCE harness, making it a confirmed exploit primitive rather than a turnkey remote attack. Reliable code execution against a live production application would still depend on how the target embeds libssh2 and what runtime protections are in place — but the core memory corruption is demonstrated and reproducible.

Patch Status

There is no fixed libssh2 release available yet. The upstream patch — commit 97acf3df, which introduces a strict guard that rejects packet_length values exceeding LIBSSH2_PACKET_MAXPAYLOAD — exists in the mainline source tree but has not been tagged as a release. Debian already ships a repaired build in its testing branch; other Linux distributions are backporting the fix individually.

What to Do Now

Until a patched release is tagged and distributed to package managers, administrators should: audit which software components on their systems link against libssh2 (curl builds, PHP SSH extensions, backup agents, and embedded firmware are common culprits); monitor for an official libssh2 release; and where operationally possible, restrict outbound SSH connections to trusted, known-good hosts.

The combination of a CVSS 9.2 score, no official patch release, a public PoC, and widespread silent inclusion in foundational developer tools makes CVE-2026-55200 one of the more significant infrastructure vulnerabilities of 2026, as first reported by The Hacker News.