libssh2 and alt-libssh2 CVEs (CVE-2026-55200, CVE-2026-55199, CVE-2025-15661)

Issue

Three vulnerabilities have been disclosed in libssh2, affecting all versions up to and including 1.11.1:

Customers are asking whether their CloudLinux servers are affected and when patched packages will be available.

The impact differs by package and CloudLinux OS version.

CloudLinux 8, 9, and 10:

Not affected from CVE-2026-55200 and CVE-2026-55199. Red Hat Enterprise Linux (RHEL) 8 and newer do not ship the libssh2 package in the base distribution, and CloudLinux follows the same policy as a downstream of RHEL. If libssh2 is installed on these systems, it was installed from the EPEL (Extra Packages for Enterprise Linux) third-party repository, which CloudLinux does not maintain. Check with the EPEL project or the upstream project at https://libssh2.org/ for a patched release.
Working on a patch for CVE-2025-15661 for CL8/CL9; for CL 10 libssh2 is not provided from Cloudlinux repositories.
CloudLinux 7:
libssh2 on CloudLinux 7 is provided by CloudLinux and covered under Extended Lifecycle Support (ELS). Check the TuxCare CVE tracker for current coverage status. Do not remove libssh2 — it is required by alt-libcurl and alt-php components. As a temporary mitigation while awaiting a patched package: restrict network access so that libssh2 clients connect only to trusted SSH servers, and use firewall rules to block untrusted incoming connections.

CloudLinux 7, 8, and 9:
alt-libssh211 is maintained by CloudLinux. A patch is currently in development and is being tracked internally as ALTPHP-2484. This article will be updated when a patched package is available. In the meantime, apply the same network-level mitigation: allow libssh2-based connections only to trusted hosts and restrict untrusted inbound connections via firewall. Do not remove alt-libssh2 — it is a dependency of alt-libcurl and multiple alt-php packages.

libssh2 versions 1.11.1 and earlier contain three vulnerabilities:

CVE-2026-55200 (Critical, CVSS 9.2) — Out-of-bounds write in transport.c caused by an unchecked packet_length value in ssh2_transport_read(). This can lead to pre-authentication remote code execution.
CVE-2026-55199 (High, CVSS 8.2) — Out-of-bounds read and infinite loop in the SSH_MSG_EXT_INFO handler in packet.c, resulting in pre-authentication denial of service (CPU exhaustion).
CVE-2025-15661 (High, CVSS 8.3) — Out-of-bounds heap read in sftp_symlink() in sftp.c, potentially causing information disclosure or a crash.

Internal task ALTPHP-2484
https://libssh2.org/ — upstream libssh2 project and release notes
https://tuxcare.com/cve-tracker/ — TuxCare CVE tracker for CloudLinux 7 ELS coverage