Affected Systems
libssh2 library versions up to and including 1.11.1. Affects any application or system using libssh2 for SSH client connections, including Git, curl, rsync wrappers, and custom SSH clients.
Exploitation Status
Public proof-of-concept available. Exploitation requires victim client to connect to attacker-controlled or compromised SSH server. No reports of active exploitation yet.
Business Impact
Critical risk for environments where automated systems or users connect to external or untrusted SSH servers. Memory corruption can lead to arbitrary code execution with privileges of the client process. Particularly dangerous in CI/CD pipelines, automated backup systems, and developer workstations performing Git operations over SSH.
Urgency
🟠Within 24 hours
Recommended Actions
- Inventory all systems and applications using libssh2 (check package managers, linked libraries via ldd, and applications like Git, curl, rsync)
- Apply vendor patches immediately when available; monitor libssh2 project and OS distribution security advisories
- Restrict SSH client connections to trusted, known-good SSH servers via firewall rules or application configuration
- Enable network monitoring to detect connections to unexpected SSH servers on port 22 and non-standard ports
- Review and audit recent SSH connections from critical systems (CI/CD, backup servers) for signs of compromise