CVE-2026-55199: libssh2 - Pre-Authentication DoS via SSH_MSG_EXT_INFO Handler

Synopsis

A pre-authentication denial-of-service vulnerability exists in the SSH_MSG_EXT_INFO handler in libssh2 through version 1.11.1. The flaw is reachable over the network without any credentials, because it triggers during the SSH key-exchange phase before authentication completes; a malicious SSH server sends a crafted extension count value (0xFFFFFFFF) that forces the connecting client into a tight CPU loop lasting over 60 seconds. Successful exploitation exhausts client CPU resources, effectively hanging the connection and any workload depending on it. A patched-image rebuild at the fix commit (1762685) is available on HarborGuard for environments running an affected version of libssh2.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must operate a reachable SSH server that the vulnerable libssh2 client connects to over the network; the malicious payload is delivered during the key-exchange handshake before any authentication occurs.

• AuthenticationNot required

  No credentials are needed; the vulnerability is triggered during the pre-authentication key-exchange phase, so an unauthenticated server can exploit connecting clients.

• Victim interactionNot required

  No user action beyond initiating an SSH connection is required; the client's normal connection attempt is sufficient to trigger the CPU exhaustion loop.

• Attack complexityDetail

  The base exploit is straightforward and condition-free (AC:L), though the CVSS vector notes an attack target precondition (AT:P), meaning the attacker must be in a position where the victim client connects to the attacker-controlled server, such as via DNS spoofing, a rogue known-host entry, or a compromised server the client already trusts.

Blast Radius

• The libssh2 client process is forced into a tight CPU loop for 60 or more seconds, consuming an entire CPU core and stalling any application logic that depends on the SSH session.
• Any workload, script, or service using libssh2 to connect to remote hosts hangs for the duration of the loop, causing timeouts and cascading failures in dependent pipelines or services.
• Repeated connections to the malicious server allow an attacker to sustain the CPU exhaustion indefinitely, effectively making the affected host unresponsive to other work.