diff --git a/net-libs/libssh/Manifest b/net-libs/libssh/Manifest
index bf6dd08f99e62..8a70ca139fea5 100644
--- a/net-libs/libssh/Manifest
+++ b/net-libs/libssh/Manifest
@@ -1,2 +1,4 @@
 DIST libssh-0.11.4.tar.xz 626652 BLAKE2B fd062e45ce7c874b4d984e21737f5cd64818163c43397a67deba8599dc74d6bd41bfea7ddd29f01a1c25de9d4c317ec9c95ad91e0712e1a58a023e8991365291 SHA512 00c7e1317dcca8feab07eb3d6feb7bbc74c563149173d439d618f431386c4ca1d6f258567ef0599f08275a3a165c04105568f55e6ed7f0fe1a88382e2ebdc850
 DIST libssh-0.11.4.tar.xz.asc 833 BLAKE2B 58c09b4061e7add06a3a613c89d7eabd3c18afb3c09c20b6b1b7712c0a3db70a0eca83ca96bd4424bb1fa93af1cc6539d0c2c4897d0c4580dad9b9fc2dfda840 SHA512 79a0d55363f92cc6e654ed5dc7208ba7c3e5e474d549305cfdc8b79b71263e238dbcdd498a0c63027731c40d06af5f3fcbdc9adc96b0ff2065e4798f048f74ab
+DIST libssh-0.11.5.tar.xz 629716 BLAKE2B 643b7259572ae8bdf9faac6bf376b10a8bd76a8dff22cfd2e2f7fd6488123ea4c1437748d19b87c1ee594ae4a417e0d00fc6dd7e2f9dd5a3ca4a2331e216bac7 SHA512 bf565de9a429d173c88a4b182c37efe242392751441e84bc30335ae95eeeb264fc2783744fbdc80267bd76a0cbb96ebef04b9d9b7f4a76890974e6ee05c14257
+DIST libssh-0.11.5.tar.xz.asc 833 BLAKE2B 9b97fea44af9ffa6d41ca4ea5a7e6df32ecde010c17a2deac052dbaca5edad13e76ca6a3ae8897d03b28aba8fdf1c31a936cbfa3e491a3fb6b38289972d06181 SHA512 2795931325740a71b9d2da55f1ac4a6eb0840efcc6d5f083fbf2861554188bb683f3a3bc772ea68d6f586525b941e78a3860afed794a6f580421ac2926a57483
diff --git a/net-libs/libssh/libssh-0.11.5.ebuild b/net-libs/libssh/libssh-0.11.5.ebuild
new file mode 100644
index 0000000000000..15b42ec4119f9
--- /dev/null
+++ b/net-libs/libssh/libssh-0.11.5.ebuild
@@ -0,0 +1,159 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit cmake-multilib dot-a
+
+DESCRIPTION="Access a working SSH implementation by means of a library"
+HOMEPAGE="https://www.libssh.org/"
+
+if [[ ${PV} == *9999* ]] ; then
+	inherit git-r3
+	EGIT_REPO_URI="https://git.libssh.org/projects/libssh.git"
+else
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/libssh.asc
+	inherit verify-sig
+	SRC_URI="
+		https://www.libssh.org/files/$(ver_cut 1-2)/${P}.tar.xz
+		verify-sig? ( https://www.libssh.org/files/$(ver_cut 1-2)/${P}.tar.xz.asc )
+	"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-libssh )"
+fi
+
+LICENSE="LGPL-2.1"
+SLOT="0/4" # subslot = soname major version
+IUSE="debug doc examples gssapi mbedtls pcap server +sftp static-libs test zlib"
+# Maintainer: check IUSE-defaults at DefineOptions.cmake
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	!mbedtls? ( >=dev-libs/openssl-1.0.1h-r2:0=[${MULTILIB_USEDEP}] )
+	gssapi? ( >=virtual/krb5-0-r1[${MULTILIB_USEDEP}] )
+	mbedtls? ( net-libs/mbedtls:3=[${MULTILIB_USEDEP},threads] )
+	zlib? ( >=virtual/zlib-1.2.8-r1:=[${MULTILIB_USEDEP}] )
+"
+DEPEND="${RDEPEND}
+	test? (
+		>=dev-util/cmocka-0.3.1[${MULTILIB_USEDEP}]
+		elibc_musl? ( sys-libs/argp-standalone )
+	)
+"
+BDEPEND+=" doc? ( app-text/doxygen[dot] )"
+
+DOCS=( AUTHORS CHANGELOG README )
+
+src_unpack() {
+	if [[ ${PV} == *9999* ]] ; then
+		git-r3_src_unpack
+	elif use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${P}.tar.xz{,.asc}
+	fi
+
+	default
+}
+
+src_prepare() {
+	# Remove custom find module to use system one
+	rm cmake/Modules/FindMbedTLS.cmake || die
+
+	cmake_src_prepare
+
+	# just install the examples, do not compile them
+	cmake_comment_add_subdirectory examples
+
+	sed -e "/^check_include_file.*HAVE_VALGRIND_VALGRIND_H/s/^/#DONT /" \
+		-i ConfigureChecks.cmake || die
+
+	if use test; then
+		local skip_tests=(
+			# keyfile torture test is currently broken
+			-e "/torture_keyfiles/d"
+
+			# Tries to expand ~ which fails w/ portage homedir
+			# (torture_path_expand_tilde_unix and torture_config_make_absolute_no_sshdir)
+			-e "/torture_misc/d"
+			-e "/torture_config/d"
+		)
+
+		# Disable tests that take too long (bug #677006)
+		if use sparc; then
+			skip_tests+=(
+				-e "/torture_threads_pki_rsa/d"
+				-e "/torture_pki_dsa/d"
+			)
+		fi
+
+		if (( ${#skip_tests[@]} )) ; then
+			sed -i "${skip_tests[@]}" tests/unittests/CMakeLists.txt || die
+		fi
+
+		if use elibc_musl; then
+			sed -e "/SOLARIS/d" -i tests/CMakeLists.txt || die
+		fi
+	fi
+}
+
+src_configure() {
+	lto-guarantee-fat
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	local mycmakeargs=(
+		-DCMAKE_DISABLE_FIND_PACKAGE_ABIMap=ON # not packaged
+		-DWITH_NACL=OFF
+		-DWITH_STACK_PROTECTOR=OFF
+		-DWITH_STACK_PROTECTOR_STRONG=OFF
+		-DWITH_DEBUG_CALLTRACE=$(usex debug)
+		-DWITH_DEBUG_CRYPTO=$(usex debug)
+		# Deprecated per CMakeLists.txt
+		-DWITH_GCRYPT=OFF
+		-DWITH_GSSAPI=$(usex gssapi)
+		-DWITH_MBEDTLS=$(usex mbedtls)
+		-DMBEDTLS_FOUND=$(usex mbedtls) # Enforce variable from custom find module
+		-DWITH_PCAP=$(usex pcap)
+		-DWITH_SERVER=$(usex server)
+		-DWITH_SFTP=$(usex sftp)
+		-DBUILD_STATIC_LIB=$(usex static-libs)
+		# TODO: try enabling {CLIENT,SERVER}_TESTING
+		-DUNIT_TESTING=$(usex test)
+		-DWITH_ZLIB=$(usex zlib)
+	)
+
+	multilib_is_native_abi || mycmakeargs+=( -DCMAKE_DISABLE_FIND_PACKAGE_Doxygen=ON )
+
+	cmake_src_configure
+}
+
+multilib_src_compile() {
+	cmake_src_compile
+	multilib_is_native_abi && use doc && cmake_src_compile docs
+}
+
+multilib_src_test() {
+	cmake_src_test --timeout 3000
+}
+
+multilib_src_install() {
+	cmake_src_install
+	multilib_is_native_abi && use doc && local HTML_DOCS=( "${BUILD_DIR}"/doc/html/. )
+
+	use static-libs && dolib.a src/libssh.a
+
+	# compatibility symlink until all consumers have been updated
+	# to no longer use libssh_threads.so
+	dosym libssh.so /usr/$(get_libdir)/libssh_threads.so
+}
+
+multilib_src_install_all() {
+	strip-lto-bytecode
+	use mbedtls && DOCS+=( README.mbedtls )
+	einstalldocs
+
+	if use examples; then
+		docinto examples
+		dodoc examples/*.{c,h,cpp}
+	fi
+}