A small GitHub repo claims CVE-2026-55200 is a pre-auth libssh2 packet_length bug affecting versions through 1.11.1, with a fixed commit named but no retained advisory text or repro evidence in this packet. Worth a look for dependency-triage practice, especially because the README mixes useful audit commands with high-severity RCE language that should be verified before anyone treats it as fact.