CVE-2026-55200 libssh2 Rogue SSH Server Oversized Packet Delivery

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•1

Detects outbound SSH connections from common applications using libssh2 to external, non-standard or untrusted servers, followed by an anomalously large inbound TCP data transfer before authentication completes. This behavior is indicative of exploitation attempts targeting CVE-2026-55200, where a malicious SSH server triggers a heap overflow in the client via a malformed packet.