CVE-2026-55199 libssh2 DoS - SSH Client CPU Spin >60s During Key Exchange

Ethan Andrews@eandrews

•updated Jun 28, 2026•0•0•9

Detects SSH client processes linked to libssh2 (such as ssh, curl, sftp, scp) exhibiting sustained high CPU usage (>=95%) for more than 60 seconds while maintaining an active outbound SSH connection. This behavior is consistent with the denial-of-service vulnerability CVE-2026-55199, where an attacker-controlled SSH server provides an excessively large extension count during the key exchange process, triggering an infinite loop within the libssh2 library.