CRITICALVulnerability
Global

Public PoC Released for Critical libssh2 CVE-2026-55200 Client-Side SSH Flaw

·Source: The Hacker News

Updated:

Executive Summary

A public proof-of-concept is now out for CVE-2026-55200, a critical flaw in libssh2 that lets a malicious or compromised SSH server trigger memory corruption on a connecting client, with possible code execution. No credentials, no user interaction. The bug affects every release up to and including 1.11.1 and carries a CVSS 4.0 score of 9.2. libssh2 is a client-side SSH library, not a server.

Analysis

A public proof-of-concept is now out for CVE-2026-55200, a critical flaw in libssh2 that lets a malicious or compromised SSH server trigger memory corruption on a connecting client, with possible code execution. No credentials, no user interaction. The bug affects every release up to and including 1.11.1 and carries a CVSS 4.0 score of 9.2. libssh2 is a client-side SSH library, not a server.

Indicators of Compromise (1)

CVE (1)
CVE-2026-55200
NVDMITRE CVE
Source Attribution

Originally published by The Hacker News on Jun 29, 2026.

Related Threats

MEDIUMVulnerability

Lloyds to retire Halifax brand

The Halifax brand is set to disappear from UK high streets after 179 years as a financial institution.

Finextra
MEDIUMVulnerability

Visa launches Visa Destinations to give travellers discounted offers

Visa’s travel offer platform Visa Destinations is now live for users across 10 locations.

Finextra
CRITICALVulnerability

NVD CRITICAL: CVE-2026-4321 — Improper neutralization of special elements used in an SQL command ('SQL injecti...

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Raera - Ankara Web Design and Digital Advertising Agency Destekz allows SQL Injection. This issue affects Destekz: through 02062026. NOTE: The vendor was contacted and it was learned that the product is not supported.

CVE-2026-4321
NIST NVD