CVE-2026-55200 is an out-of-bounds write vulnerability in the libssh2 client library, triggered by processing an SSH packet with an abnormally large length value. This leads to heap corruption and potential application crash. Exploitation requires the client to connect to an attacker-controlled SSH server, which may be achieved via DNS poisoning, man-in-the-middle, or trusted host compromise. While arbitrary code execution is theoretically possible, it is considered unlikely in practice due to ASLR, glibc heap integrity checks, and the need for additional information disclosure vulnerabilities. Red Hat Hardened Images have been updated with libssh2 version 1.11.1-8.hum1 to fix this issue. RHEL 8.1 and later do not include libssh2 and are unaffected. The vulnerability is tracked under CVE-2026-55200 and CVE-2026-55199, with CWE-606 (Unchecked Input for Loop Condition) referenced. No CVSS score is provided by Red Hat, but the impact is rated medium.

The vulnerability allows remote attackers to cause memory corruption and crash the libssh2 client process, resulting in denial of service. Remote code execution is theoretically possible but highly unlikely due to required conditions including client redirection to attacker-controlled servers, ASLR, and heap metadata integrity checks. The practical impact is limited by the need for victim-initiated connections to malicious servers and network-level mitigations. RHEL 8.1 and later are not affected as they do not include libssh2.

Red Hat has released updated libssh2 RPM packages (version 1.11.1-8.hum1) for Red Hat Hardened Images to address this vulnerability. Users should apply these updates promptly. Additionally, strict network access controls should be enforced to ensure libssh2 clients connect only to trusted SSH servers. Firewalls should be used to block untrusted incoming connections if libssh2 is deployed in server-side roles. RHEL 8.1 and later are not affected and require no action. No other mitigations are indicated by the vendor advisory.