A critical heap overflow vulnerability (CVE-2026-55200, CVSS 9.8) in libssh2 allows a malicious SSH server to exploit connecting clients before authentication, with no credentials required. The flaw in ssh2_transport_read() involves a 32-bit integer wrap that shrinks a heap allocation to as little as 19 bytes, enabling a full payload write into that buffer. A public PoC dropped June 29, but no official tagged release includes the upstream fix (merged June 12). Debian has patched trixie and sid; Ubuntu and other distros are still evaluating. Embedded systems and appliances may wait months for firmware updates. The broader concern is that outbound SSH clients — curl, Git, PHP's SSH extension, CI runners, backup tools — are widely trusted but systematically underpatched because developers don't think of them as attack surfaces. Mitigation involves applying distro patches or cherry-picking commits 97acf3d and 1762685 from upstream.
