Skip to main content

libssh2 CVE-2026-7598

| EUVDEUVD-2026-26722 MEDIUM
Integer Overflow or Wraparound (CWE-190)
2026-05-01 VulDB
Buffer Overflow Integer Overflow N A Libssh2
6.9
CVSS 4.0 · Vendor: VulDB
Share

Severity by source

Vendor (VulDB) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
SUSE
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Red Hat
9.1 HIGH
qualitative

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

8
Severity Changed
May 01, 2026 - 22:22 NVD
HIGH MEDIUM
CVSS changed
May 01, 2026 - 22:22 NVD
7.3 (HIGH) 6.9 (MEDIUM)
Source Code Evidence Fetched
May 01, 2026 - 22:15 vuln.today
Analysis Generated
May 01, 2026 - 22:15 vuln.today
EUVD ID Assigned
May 01, 2026 - 21:46 euvd
EUVD-2026-26722
Analysis Generated
May 01, 2026 - 21:46 vuln.today
Patch released
May 01, 2026 - 21:46 nvd
Patch available
CVE Published
May 01, 2026 - 21:30 nvd
MEDIUM 6.9

DescriptionCVE.org

A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The name of the patch is 256d04b60d80bf1190e96b0ad1e91b2174d744b1. A patch should be applied to remediate this issue.

AnalysisAI

Integer overflow in libssh2 up to version 1.11.1 allows remote unauthenticated attackers to cause memory corruption during SSH password authentication. The vulnerability exists in the userauth_password function where inadequate bounds checking on username_len and password_len parameters can trigger integer overflow when calculating buffer sizes, potentially leading to confidentiality breach, integrity compromise, and service disruption. Upstream fix available via GitHub commit 256d04b60d80bf1190e96b0ad1e91b2174d744b1. No active exploitation confirmed (not in CISA KEV), but publicly accessible patch reveals exact exploitation technique.

Technical ContextAI

libssh2 is a widely-used C library implementing the SSH2 protocol, commonly integrated into applications like curl, git, and various file transfer tools. This vulnerability (CWE-190: Integer Overflow) occurs in src/userauth.c during SSH password authentication. The root cause is arithmetic overflow when the userauth_password function sums username_len, password_len, and protocol overhead constants (27, 40, or 44 bytes depending on code path) to allocate packet buffers. If username_len or password_len values approach UINT32_MAX, the addition wraps around to a small positive integer, causing undersized buffer allocation. Subsequent operations writing username and password data into this undersized buffer can corrupt heap metadata or adjacent memory regions. The patch adds explicit overflow checks comparing username_len against (UINT32_MAX - overhead) before arithmetic, and rewrites the conditional from additive form to subtraction-resistant form to prevent wraparound.

RemediationAI

Apply the upstream fix by upgrading to libssh2 versions incorporating commit 256d04b60d80bf1190e96b0ad1e91b2174d744b1 available at https://github.com/libssh2/libssh2/commit/256d04b60d80bf1190e96b0ad1e91b2174d744b1 and https://github.com/libssh2/libssh2/pull/1858. Note: Upstream fix available as PR/commit; released patched version not independently confirmed at time of analysis - verify with distribution vendors for packaged updates. For systems unable to immediately patch, implement compensating controls by deploying network-layer SSH traffic inspection to reject authentication packets with username or password length fields exceeding reasonable thresholds (recommend 256 bytes for username, 1024 bytes for password). This may break legitimate use cases involving very long credentials but significantly reduces attack surface. Additionally, restrict SSH service exposure to trusted networks via firewall rules, reducing remote attack opportunities. If libssh2 is used in application code, add input validation rejecting username_len or password_len values exceeding 1024 bytes before passing to libssh2 API - note this adds application-layer complexity and may conflict with future legitimate protocol usage.

More in N A

View all
CVE-2024-51092 CRITICAL POC
9.1 May 08

LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
CVE-2025-15684 MEDIUM POC
5.5 Aug 12

Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
CVE-2024-45257 HIGH POC
7.3 May 08

A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
CVE-2025-15687 LOW POC
2.1 Aug 12

Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
CVE-2025-15686 LOW POC
2.1 Aug 12

Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
CVE-2025-67888 HIGH POC
7.3 May 08

Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root

CVE-2024-53326 HIGH POC
7.3 May 08

LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
CVE-2026-38360 CRITICAL POC
9.8 May 08

Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
CVE-2026-30623 CRITICAL POC
9.8 Jul 15

Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
CVE-2026-67917 CRITICAL POC
9.8 Aug 17

SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
CVE-2026-75337 CRITICAL POC
9.8 Aug 27

Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
CVE-2026-31072 CRITICAL POC
9.8 May 19

Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5
CVE-2016-1010 HIGH
8.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.3 Fixed

Share

CVE-2026-7598 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy