[Buildroot] [PATCH v2 1/2] package/libssh2: add upstream patch for CVE-2026-55199

[Buildroot] [PATCH v2 1/2] package/libssh2: add upstream patch for CVE-2026-55199

[Thomas Perale via buildroot]

Fixes the following vulnerability:

- CVE-2026-55199:
    libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-
    authentication denial of service vulnerability in the SSH_MSG_EXT_INFO
    handler in src/packet.c that allows a malicious SSH server to cause a
    client CPU exhaustion loop by sending a crafted extension count value.
    A malicious server can set nr_extensions to 0xFFFFFFFF during key
    exchange, causing the client to spin in a tight CPU loop for over 60
    seconds because return values from _libssh2_get_string() are unchecked
    and the session timeout does not apply to CPU-bound loops.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2026-55199
  - https://github.com/libssh2/libssh2/commit/17626857d20b3c9a1addfa45979dadcee1cd84a4

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
 ...et-string-return-in-EXT-INFO-handler.patch | 43 +++++++++++++++++++
 package/libssh2/libssh2.mk                    |  3 ++
 2 files changed, 46 insertions(+)
 create mode 100644 package/libssh2/0002-packet-check-libssh2-get-string-return-in-EXT-INFO-handler.patch

diff --git a/package/libssh2/0002-packet-check-libssh2-get-string-return-in-EXT-INFO-handler.patch b/package/libssh2/0002-packet-check-libssh2-get-string-return-in-EXT-INFO-handler.patch
new file mode 100644
index 0000000000..c7319a6b51
--- /dev/null
+++ b/package/libssh2/0002-packet-check-libssh2-get-string-return-in-EXT-INFO-handler.patch
@@ -0,0 +1,43 @@
+From 17626857d20b3c9a1addfa45979dadcee1cd84a4 Mon Sep 17 00:00:00 2001
+From: TristanInSec <tristan.mtn@gmail.com>
+Date: Wed, 15 Apr 2026 14:51:08 -0400
+Subject: [PATCH] packet: check `_libssh2_get_string()` return in `EXT_INFO`
+ handler
+
+The `SSH_MSG_EXT_INFO` handler discards the return values from
+`_libssh2_get_string()` when parsing extension name/value pairs. When
+the buffer is exhausted before all claimed extensions are parsed,
+the loop continues with no-op iterations until `nr_extensions` reaches
+zero.
+
+The `nr_extensions >= 1024` cap limits the worst case, but the loop
+should still break on parse failure for correctness and consistency
+with other parsers in this file (e.g. `SSH_MSG_CHANNEL_OPEN`,
+`SSH_MSG_KEXINIT`) that check `_libssh2_get_string()` return values.
+
+Closes #1864
+
+CVE: CVE-2026-55199
+Upstream: https://github.com/libssh2/libssh2/commit/17626857d20b3c9a1addfa45979dadcee1cd84a4
+Signed-off-by: Thomas Perale <thomas.perale@mind.be>
+---
+ src/packet.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/src/packet.c b/src/packet.c
+index ae86365d2a..8a7a0d2690 100644
+--- a/src/packet.c
++++ b/src/packet.c
+@@ -868,8 +868,10 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
+ 
+                     nr_extensions -= 1;
+ 
+-                    _libssh2_get_string(&buf, &name, &name_len);
+-                    _libssh2_get_string(&buf, &value, &value_len);
++                    if(_libssh2_get_string(&buf, &name, &name_len))
++                        break;
++                    if(_libssh2_get_string(&buf, &value, &value_len))
++                        break;
+ 
+                     if(name && value) {
+                         _libssh2_debug((session,
diff --git a/package/libssh2/libssh2.mk b/package/libssh2/libssh2.mk
index 1843d25051..c85129a7cd 100644
--- a/package/libssh2/libssh2.mk
+++ b/package/libssh2/libssh2.mk
@@ -16,6 +16,9 @@ LIBSSH2_CONF_OPTS = --disable-examples-build --disable-rpath
 # 0001-username-len-bound-checking.patch
 LIBSSH2_IGNORE_CVES += CVE-2026-7598
 
+# 0002-packet-check-libssh2-get-string-return-in-EXT-INFO-handler.patch
+LIBSSH2_IGNORE_CVES += CVE-2026-55199
+
 ifeq ($(BR2_PACKAGE_LIBSSH2_MBEDTLS),y)
 LIBSSH2_DEPENDENCIES += mbedtls
 LIBSSH2_CONF_OPTS += --with-libmbedcrypto-prefix=$(STAGING_DIR)/usr \
-- 
2.54.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [PATCH v2 2/2] package/libssh2: backport upstream patch for CVE-2026-55200

[Thomas Perale via buildroot]

- CVE-2026-55200:
    libssh2 through 1.11.1, fixed in commit 97acf3df contains an out-of-
    bounds write vulnerability in ssh2_transport_read() that fails to
    enforce upper bounds on packet_length field. Remote attackers can send
    crafted SSH packets with excessively large packet_length values to
    corrupt heap memory and achieve remote code execution.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2026-55200
  - https://github.com/libssh2/libssh2/commit/97acf3dfda80c91c3a8c9f2372546301d4a1a7a8

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
v1 -> v2: fix the URL in the commit message and the commit id miswritten
    from cve.org
---
 ...al-boundary-checks-for-packet-length.patch | 36 +++++++++++++++++++
 package/libssh2/libssh2.mk                    |  3 ++
 2 files changed, 39 insertions(+)
 create mode 100644 package/libssh2/0003-transport-c-Additional-boundary-checks-for-packet-length.patch

diff --git a/package/libssh2/0003-transport-c-Additional-boundary-checks-for-packet-length.patch b/package/libssh2/0003-transport-c-Additional-boundary-checks-for-packet-length.patch
new file mode 100644
index 0000000000..ef54771afc
--- /dev/null
+++ b/package/libssh2/0003-transport-c-Additional-boundary-checks-for-packet-length.patch
@@ -0,0 +1,36 @@
+From 97acf3dfda80c91c3a8c9f2372546301d4a1a7a8 Mon Sep 17 00:00:00 2001
+From: Will Cosgrove <will@panic.com>
+Date: Fri, 12 Jun 2026 15:57:44 -0700
+Subject: [PATCH] transport.c: Additional boundary checks for packet length
+ (#2052)
+
+Add additional bounds checking on packet length to prevent OOB write.
+
+Credit: [TristanInSec](https://github.com/TristanInSec)
+
+CVE: CVE-2026-55200
+Upstream: https://github.com/libssh2/libssh2/commit/97acf3dfda80c91c3a8c9f2372546301d4a1a7a8
+[thomas: backport to 1.11.1, change ntohu32 call]
+Signed-off-by: Thomas Perale <thomas.perale@mind.be>
+---
+ src/transport.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/src/transport.c b/src/transport.c
+index 869fc5a4fa..7925ad33d1 100644
+--- a/src/transport.c
++++ b/src/transport.c
+@@ -645,8 +645,12 @@ int ssh2_transport_read(LIBSSH2_SESSION *session)
+                 total_num = 4;
+ 
+                 p->packet_length = _libssh2_ntohu32(block);
+-                if(p->packet_length < 1)
++                if(p->packet_length < 1) {
+                     return LIBSSH2_ERROR_DECRYPT;
++                }
++                else if(p->packet_length > LIBSSH2_PACKET_MAXPAYLOAD) {
++                    return LIBSSH2_ERROR_OUT_OF_BOUNDARY;
++                }
+ 
+                 /* total_num may include size field, however due to existing
+                  * logic it needs to be removed after the entire packet is read
diff --git a/package/libssh2/libssh2.mk b/package/libssh2/libssh2.mk
index c85129a7cd..0ccf5effb3 100644
--- a/package/libssh2/libssh2.mk
+++ b/package/libssh2/libssh2.mk
@@ -19,6 +19,9 @@ LIBSSH2_IGNORE_CVES += CVE-2026-7598
 # 0002-packet-check-libssh2-get-string-return-in-EXT-INFO-handler.patch
 LIBSSH2_IGNORE_CVES += CVE-2026-55199
 
+# 0003-transport-c-Additional-boundary-checks-for-packet-length.patch
+LIBSSH2_IGNORE_CVES += CVE-2026-55200
+
 ifeq ($(BR2_PACKAGE_LIBSSH2_MBEDTLS),y)
 LIBSSH2_DEPENDENCIES += mbedtls
 LIBSSH2_CONF_OPTS += --with-libmbedcrypto-prefix=$(STAGING_DIR)/usr \
-- 
2.54.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH v2 1/2] package/libssh2: add upstream patch for CVE-2026-55199

[Fiona Klute via buildroot]

Am 30.06.26 um 21:41 schrieb Thomas Perale:
> Fixes the following vulnerability:
> 
> - CVE-2026-55199:
>      libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-
>      authentication denial of service vulnerability in the SSH_MSG_EXT_INFO
>      handler in src/packet.c that allows a malicious SSH server to cause a
>      client CPU exhaustion loop by sending a crafted extension count value.
>      A malicious server can set nr_extensions to 0xFFFFFFFF during key
>      exchange, causing the client to spin in a tight CPU loop for over 60
>      seconds because return values from _libssh2_get_string() are unchecked
>      and the session timeout does not apply to CPU-bound loops.
> 
> For more information, see:
>    - https://www.cve.org/CVERecord?id=CVE-2026-55199
>    - https://github.com/libssh2/libssh2/commit/17626857d20b3c9a1addfa45979dadcee1cd84a4
> 
> Signed-off-by: Thomas Perale <thomas.perale@mind.be>

And series applied to master, thank you!

> ---
>   ...et-string-return-in-EXT-INFO-handler.patch | 43 +++++++++++++++++++
>   package/libssh2/libssh2.mk                    |  3 ++
>   2 files changed, 46 insertions(+)
>   create mode 100644 package/libssh2/0002-packet-check-libssh2-get-string-return-in-EXT-INFO-handler.patch
> 
> diff --git a/package/libssh2/0002-packet-check-libssh2-get-string-return-in-EXT-INFO-handler.patch b/package/libssh2/0002-packet-check-libssh2-get-string-return-in-EXT-INFO-handler.patch
> new file mode 100644
> index 0000000000..c7319a6b51
> --- /dev/null
> +++ b/package/libssh2/0002-packet-check-libssh2-get-string-return-in-EXT-INFO-handler.patch
> @@ -0,0 +1,43 @@
> +From 17626857d20b3c9a1addfa45979dadcee1cd84a4 Mon Sep 17 00:00:00 2001
> +From: TristanInSec <tristan.mtn@gmail.com>
> +Date: Wed, 15 Apr 2026 14:51:08 -0400
> +Subject: [PATCH] packet: check `_libssh2_get_string()` return in `EXT_INFO`
> + handler
> +
> +The `SSH_MSG_EXT_INFO` handler discards the return values from
> +`_libssh2_get_string()` when parsing extension name/value pairs. When
> +the buffer is exhausted before all claimed extensions are parsed,
> +the loop continues with no-op iterations until `nr_extensions` reaches
> +zero.
> +
> +The `nr_extensions >= 1024` cap limits the worst case, but the loop
> +should still break on parse failure for correctness and consistency
> +with other parsers in this file (e.g. `SSH_MSG_CHANNEL_OPEN`,
> +`SSH_MSG_KEXINIT`) that check `_libssh2_get_string()` return values.
> +
> +Closes #1864
> +
> +CVE: CVE-2026-55199
> +Upstream: https://github.com/libssh2/libssh2/commit/17626857d20b3c9a1addfa45979dadcee1cd84a4
> +Signed-off-by: Thomas Perale <thomas.perale@mind.be>
> +---
> + src/packet.c | 6 ++++--
> + 1 file changed, 4 insertions(+), 2 deletions(-)
> +
> +diff --git a/src/packet.c b/src/packet.c
> +index ae86365d2a..8a7a0d2690 100644
> +--- a/src/packet.c
> ++++ b/src/packet.c
> +@@ -868,8 +868,10 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
> +
> +                     nr_extensions -= 1;
> +
> +-                    _libssh2_get_string(&buf, &name, &name_len);
> +-                    _libssh2_get_string(&buf, &value, &value_len);
> ++                    if(_libssh2_get_string(&buf, &name, &name_len))
> ++                        break;
> ++                    if(_libssh2_get_string(&buf, &value, &value_len))
> ++                        break;
> +
> +                     if(name && value) {
> +                         _libssh2_debug((session,
> diff --git a/package/libssh2/libssh2.mk b/package/libssh2/libssh2.mk
> index 1843d25051..c85129a7cd 100644
> --- a/package/libssh2/libssh2.mk
> +++ b/package/libssh2/libssh2.mk
> @@ -16,6 +16,9 @@ LIBSSH2_CONF_OPTS = --disable-examples-build --disable-rpath
>   # 0001-username-len-bound-checking.patch
>   LIBSSH2_IGNORE_CVES += CVE-2026-7598
>   
> +# 0002-packet-check-libssh2-get-string-return-in-EXT-INFO-handler.patch
> +LIBSSH2_IGNORE_CVES += CVE-2026-55199
> +
>   ifeq ($(BR2_PACKAGE_LIBSSH2_MBEDTLS),y)
>   LIBSSH2_DEPENDENCIES += mbedtls
>   LIBSSH2_CONF_OPTS += --with-libmbedcrypto-prefix=$(STAGING_DIR)/usr \

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot