Loading vulnerability…
CVE-2026-55199 is a pre-authentication denial-of-service vulnerability in the SSH_MSG_EXT_INFO handler in libssh2 through version 1.11.1. During key exchange, a malicious SSH server can supply an extension count of 0xFFFFFFFF, causing the connecting client to enter a tight CPU-bound loop lasting more than 60 seconds. Unchecked return values from _libssh2_get_string() allow processing to continue, while the session timeout does not apply to CPU-bound loops. Upstream commit 1762685 fixes the vulnerability.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
36 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A pre-authentication denial-of-service flaw in the SSH_MSG_EXT_INFO handler allows a malicious SSH server to cause prolonged client CPU exhaustion with a crafted extension count during key exchange. Session timeouts do not interrupt the CPU-bound loop. Fixed in commit 1762685.
A pre-authentication denial-of-service vulnerability in libssh2's SSH_MSG_EXT_INFO handler. Unchecked string-parsing return values and an attacker-controlled extension count cause CPU exhaustion in a loop not covered by the session timeout. Fixed in commit 1762685.
A pre-authentication CPU-exhaustion flaw in libssh2's SSH extension-information handler. A malicious server can supply an extension count of 0xFFFFFFFF during key exchange, causing a tight loop lasting over 60 seconds because string-parser return values are unchecked and session timeouts do not interrupt CPU-bound loops. Fixed in commit 1762685. The plugin reports available exploits collectively, but does not specifically attribute exploit availability to this CVE.
Unchecked parsing return values in the SSH_MSG_EXT_INFO handler permit a malicious SSH server to cause pre-authentication CPU exhaustion using a crafted extension count. Session timeouts do not interrupt the CPU-bound loop. Fixed in commit 1762685; updated EulerOS packages are available. Exploit availability is reported only at the aggregate plugin level.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.