A pre-authentication denial of service (DoS) vulnerability exists in libssh2 through version 1.11.1_3. The flaw is in the SSH_MSG_EXT_INFO handler, where a malicious SSH server can send a crafted extension count value causing the client to enter a CPU exhaustion loop during key exchange. This results in the client spinning in a tight loop for over 60 seconds, leading to denial of service. The issue is fixed in libssh2 version 1.11.1_3.