Critical libssh2 Flaw (CVE-2026-55200): How to Check If Your Servers Are Affected and Patch Immediately

A public proof-of-concept exploit is now available for CVE-2026-55200, a critical vulnerability in libssh2 that carries a CVSS 4.0 score of 9.2. The flaw allows a malicious or compromised SSH server to trigger memory corruption on any client that connects to it , which means potential remote code execution, and not in the direction most admins expect.

The vulnerable library is embedded in a surprising number of tools: curl, git, rsync, and many custom applications that use SSH as a transport. If your servers run any of these, you need to act.

What CVE-2026-55200 actually does

The vulnerability sits in the libssh2 client-side handshake code. When a client connects to an SSH server, a crafted response from the server can corrupt memory on the client machine. This is the inverse of what most SSH vulnerabilities look like , usually you worry about the server being attacked, not the client.

The practical implication: any automated process that connects to external SSH servers could be compromised. CI/CD pipelines that pull from git over SSH. Backup scripts that rsync to remote hosts. Monitoring tools that use SSH-based checks. If an attacker compromises any SSH server these tools connect to, they can potentially execute code on the client side.

Check if you’re running a vulnerable version

First, determine whether libssh2 is installed and which version:

# Check via package manager
dpkg -l | grep libssh2    # Debian/Ubuntu
rpm -qa | grep libssh2    # RHEL/Rocky

# Check the shared library version
find /usr/lib /usr/lib64 -name "libssh2.so*" 2>/dev/null

# Check which binaries link against libssh2
lsof | grep libssh2

All versions up to and including 1.11.1 are affected. The fix landed in version 1.11.2, released on June 30, 2026.

For servers that have libssh2 installed via the system package manager:

# Ubuntu/Debian
sudo apt update && apt-cache policy libssh2-1

# If 1.11.2 or newer is available:
sudo apt install --only-upgrade libssh2-1

# RHEL/Rocky
sudo dnf check-update libssh2
sudo dnf update libssh2

What to do if your distro hasn’t shipped the patch yet

Not every distribution has pushed the 1.11.2 update to their stable repositories. If the patched version is not yet available through your package manager, you have two options.

Option 1: Build from source

wget https://libssh2.org/download/libssh2-1.11.2.tar.gz
tar -xzf libssh2-1.11.2.tar.gz
cd libssh2-1.11.2
./configure --prefix=/usr/local
make
sudo make install
sudo ldconfig

Option 2: Restrict outbound SSH connections

If building from source is not feasible, limit which SSH servers your machines connect to until the patch is available:

# Block outbound SSH to untrusted hosts with iptables
sudo iptables -A OUTPUT -p tcp --dport 22 -d <trusted-server-ip> -j ACCEPT
sudo iptables -A OUTPUT -p tcp --dport 22 -j DROP

This is a blunt instrument , it breaks any automated SSH connections to hosts not on your allowlist , but it is preferable to leaving the vulnerability exposed when a public PoC is circulating.

Check applications that bundle their own libssh2

Some applications statically link or vendor their own copy of libssh2. These will not be updated by your system package manager. Common culprits:

• curl with SSH support: Run curl --version and look for libssh2/1.x.x in the features list. If the version is 1.11.1 or older, update curl.
• Git: Git bundles libssh2 on some platforms. Run git --version and then check your distribution’s git package changelog.
• Custom applications: Any in-house tool that uses SSH for file transfer or remote execution may link against libssh2. Check with ldd /path/to/binary | grep ssh2.

For containers, rebuild your images with the updated base:

docker pull ubuntu:22.04
docker build --no-cache -t your-app:patched .

Verify the fix

After patching, confirm the running version:

# Check the library version
strings /usr/lib/x86_64-linux-gnu/libssh2.so.1 | grep "^1\\."

# Check that running processes pick up the new library
# (may require restarting services)
sudo systemctl restart sshd

Then test a basic SSH connection to verify nothing broke:

ssh -T git@github.com 2>&1 | head -1
# Should show authentication success/failure message, not a crash

If you have monitoring in place, watch for unusual outbound SSH connection patterns in the days after patching. A compromised client may have established persistence before you applied the fix.

Automate detection across your fleet

If you manage more than a handful of servers, checking each one manually is not practical. Use a configuration management tool to audit libssh2 versions across your entire infrastructure.

Ansible ad-hoc check:

ansible all -m shell -a "dpkg -l libssh2-1 2>/dev/null | grep libssh2 || rpm -q libssh2 2>/dev/null" -o

Shell script for a server list:

#!/bin/bash
for host in $(cat servers.txt); do
    version=$(ssh "$host" "dpkg -l libssh2-1 2>/dev/null | grep '^ii' | awk '{print \$3}' || rpm -q --qf '%{VERSION}' libssh2 2>/dev/null")
    if [[ -z "$version" ]]; then
        echo "$host: libssh2 NOT INSTALLED"
    elif [[ "$version" == "1.11.1" ]] || [[ "$(echo "$version" | cut -d. -f1-3)" < "1.11.2" ]]; then
        echo "$host: VULNERABLE ($version)"
    else
        echo "$host: OK ($version)"
    fi
done

Why this CVE matters more than the score suggests

A 9.2 CVSS score already signals severity, but CVE-2026-55200 deserves extra attention for two reasons that the score alone does not capture.

First, the attack direction is client-side. Most organizations have SSH server hardening procedures. Few have equivalent procedures for SSH client connections, because client-side SSH vulnerabilities have historically been rare. That asymmetry means this attack surface is largely unmonitored.

Second, the public PoC lowers the barrier to exploitation dramatically. When a PoC circulates for a server-side vulnerability, defenders can prioritize patching internet-facing services. But for a client-side vulnerability, the attack can come from any SSH server your infrastructure connects to, including third-party services, vendors, and even compromised internal hosts.

The window between PoC release and widespread exploitation for client-side flaws tends to be shorter than for server-side ones, because the targets are harder to inventory. Attackers know defenders will take longer to find every affected client.

Post-patch: audit your outbound SSH connections

After patching, take inventory of every outbound SSH connection your servers make. The fastest way to do this is with auditd:

sudo auditctl -a exit,always -F arch=b64 -S connect -F a0=2 -k outbound-ssh

Let it run for 24 hours, then review:

sudo ausearch -k outbound-ssh --raw | aureport -h --summary

This will show every host your servers connected to on port 22. Cross-reference the list against your known services. Anything you do not recognize should be investigated — it could be a legitimate integration you forgot about, or it could be an indicator that a compromised SSH server was used to target your client before you patched.