Libssh2 is a widely embedded SSH client library that, despite being a single focused product, sits deep in the software supply chain and is bundled across numerous servers, appliances, and applications. Its vulnerabilities skew strongly toward critical-severity outcomes and frequently acquire public exploit code, reflecting the protocol-parsing complexity and memory-safety demands of SSH implementation; the recurring weakness classes—integer overflows, out-of-bounds reads and writes, sensitive information exposure, and length-parameter handling errors—are characteristic of low-level network protocol libraries where parsing logic directly touches privileged state. Defenders should inventory products that bundle this library rather than tracking the library alone, since a single flaw can propagate across the supply chain; live severity and exploitation figures are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Libssh2 over time
Signals from CVEs in this vendor scope (21 CVEs).
21 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-48795MEDIUM The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packet | Dec 18, 2023 | 5.9 | 81 | NO | YES |
CVE-2026-55200HIGH libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Re | Jun 17, 2026 | 8.3 | 45 | NO | NO |
CVE-2026-58050HIGH libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation num_attrs * sizeof(libssh2_publickey_at | Jun 28, 2026 | 7.5 | 38 | NO | NO |
CVE-2026-55199HIGH libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicio | Jun 17, 2026 | 7.5 | 37 | NO | NO |
CVE-2026-7598HIGH A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argu | May 1, 2026 | 7.3 | 35 | NO | NO |
CVE-2026-58051MEDIUM libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup pa | Jun 28, 2026 | 6.5 | 34 | NO | NO |
CVE-2019-3855HIGH An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compro | Mar 21, 2019 | 8.8 | 34 | NO | NO |
CVE-2019-3862CRITICAL An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed. A remote attacke | Mar 21, 2019 | 9.1 | 34 | NO | NO |
CVE-2025-15661MEDIUM libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c that allows a malicious SSH server o | Jun 18, 2026 | 6.5 | 33 | NO | NO |
CVE-2019-13115HIGH In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds read in the way packets a | Jul 16, 2019 | 8.1 | 31 | NO | NO |
Signals from CVEs in this vendor scope (21 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Libssh2.
Media articles that mention a CVE ID that affects a product developed by Libssh2 — matched by CVE ID, not by vendor name.