From: Todd Zullinger <tmz@pobox.com>
Date: Tue, 07 Jul 2026 16:24:52 GMT
Subject: Re: CVE-2026-55200 libssh2
Message-ID: <20260707162452._tjDEpzZ@teonanacatl.net>
In-Reply-To: <26531fd0-4a21-c8ef-84a9-25c871cde303@gmx.de>

Hi,

Johannes Schindelin wrote:
> Back to your question why Git for Windows still only includes v1.11.1 of
> libssh2. The answer is rather trivial: MSYS2 (on which Git for Windows is
> based through a healthy collaboration) includes only that version:
> 
> https://packages.msys2.org/base/mingw-w64-libssh2
> 
> And the reason for _that_ might be rooted in the fact that both the
> repository as well as the website of libssh2 list that as the very latest
> available version:
> 
> - https://github.com/libssh2/libssh2/releases/latest currently redirects
>   to https://github.com/libssh2/libssh2/releases/tag/libssh2-1.11.1
> 
> - https://libssh2.org/ says:
> 
>   Download
>   libssh2 1.11.1, released on 2024-10-16. *link to Changelog*
> 
> Easy explanation, right?

Indeed.  :)

An upstream issue requesting a release to aid in the
distribution of these fixes was filed about 2 months ago
(after CVE-2026-7598, before CVE-2026-55200 and some
others):

    https://github.com/libssh2/libssh2/issues/1925

That may be worth tracking for anyone curious.

-- 
Todd