libssh2 CVE-2026-55200 public PoC critical client-side SSH RCE curl Git PHP no fix
A public proof-of-concept now exists for a critical libssh2 flaw (CVE-2026-55200) that lets a malicious SSH server run code on any client that connects to it. No password, no click needed. libssh2 ships inside curl, Git, PHP and firmware updaters, and no fixed release exists yet.
A public proof-of-concept is now circulating for CVE-2026-55200, a critical vulnerability in libssh2 that inverts how most people think about SSH risk. Normally the server is the fortress under attack. Here it is the client that is exposed: a malicious or compromised SSH server can corrupt memory on any program that connects to it and potentially run arbitrary code. The flaw sits in the routine that parses incoming packets during the initial handshake, which means it fires before authentication happens. No password, no user interaction, no click. Rated CVSS 9.2, it affects every libssh2 release up to and including version 1.11.1. What makes this serious is where libssh2 lives. It is quietly embedded in curl, Git, PHP, backup agents, firmware updaters and a long tail of network appliances. Any of those tools that reaches out to an untrusted SSH endpoint becomes a potential entry point. Security researcher Tristan Madani reported the issue, the fix was merged into the mainline source on June 12, and VulnCheck published the CVE on June 17. The catch: there is still no tagged, fixed release. The patch exists in source, so Linux distributions and downstream projects are backporting it individually, which leaves an uneven patchwork of protected and unprotected systems. According to reporting from The Hacker News and heise online, CISA lists no confirmed exploitation in the wild for now, and the public proof-of-concept lowers the bar for that to change. The practical step for anyone running software that links libssh2 is to track their distribution's backported update rather than waiting for an official upstream release.