Which versions of THC Hydra are affected by EUVD-2026-39515?

THC Hydra password-testing tool version 9.7 contains a critical remote code execution vulnerability (CVE-2026-56766, CVSS 8.6) that could turn your security team's own testing infrastructure into an…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-39515?

Yes, a public proof-of-concept exploit is available for EUVD-2026-39515. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate EUVD-2026-39515?

Within 24 hours: Identify and inventory all systems running THC Hydra, determine which teams/systems use it, and restrict outbound connectivity to pre-approved targets only. Within 7 days: Update all THC Hydra instances to patched version (commit 9cc84c2 or later). Within 30 days: Audit Hydra usage logs for connections to external or untrusted hosts, verify patch deployment across all systems, and implement network segmentation policies for credential-testing tools.

THC Hydra EUVD-2026-39515

Q: What is the CVSS score of EUVD-2026-39515?

EUVD-2026-39515 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

| CVE-2026-56766 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-06-25 VulnCheck

GHSA-3r6x-6cp5-6575

RCE Buffer Overflow Stack Overflow Red Hat Thc Hydra

8.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-reachable but the victim must run Hydra against the malicious server (UI:R), and reliable RCE depends on the host lacking stack protection (AC:H); success yields full code execution (C/I/A:H).

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 25, 2026 - 18:54 vuln.today

Analysis Generated

Jun 25, 2026 - 18:54 vuln.today

DescriptionCVE.org

Hydra through 9.7, fixed in commit 9cc84c2, contains a stack buffer overflow in NTLM authentication across SMTP, POP3, IMAP, NNTP, HTTP, HTTP-Proxy, and HTTP-Proxy-Urlenum modules when processing malicious NTLM Type-2 challenges. A malicious server can send a crafted NTLM Type-2 challenge with an excessively long domain string, causing base64-encoded response data to overflow a 500-byte stack buffer by 18 to 330 bytes, enabling remote code execution on systems without stack protection.

AnalysisAI

Remote code execution in THC Hydra through 9.7 allows a malicious or attacker-controlled server to compromise the machine running the Hydra brute-force client during NTLM authentication. When Hydra connects to such a server across its SMTP, POP3, IMAP, NNTP, HTTP, HTTP-Proxy, or HTTP-Proxy-Urlenum modules, a crafted NTLM Type-2 challenge with an overlong domain string causes the base64-encoded response to overflow a 500-byte stack buffer by 18 to 330 bytes, enabling code execution on hosts lacking stack protection. No public exploit identified at time of analysis, but a vendor patch (commit 9cc84c2) is available, and the issue inverts the usual threat model - the operator of the offensive tool becomes the victim.

Technical ContextAI

Hydra is the widely used vanhauser-thc/thc-hydra network login brute-forcing tool. The flaw is a CWE-121 stack-based buffer overflow in its NTLM authentication handling. NTLM is a three-message handshake; here Hydra (the client) parses a server-supplied Type-2 challenge that contains a server-controlled domain/target string, then builds the base64-encoded Type-3 response. Across seven protocol modules that response is assembled (via sprintf into a fixed ~500-byte stack buffer) without validating that the server-controlled domain length plus protocol/header bytes will fit, so an oversized domain inflates the base64 output past the buffer boundary. The CPE cpe:2.3:a:vanhauser-thc:thc-hydra:*:*:*:*:*:*:*:* confirms the affected product, and the upstream commit diff shows the fix adds length guards (returning error 3 on oversized responses) to hydra-imap.c, hydra-nntp.c, hydra-pop3.c, hydra-smtp.c, hydra-http-proxy.c, and hydra-http-proxy-urlenum.c, while hydra-http.c instead dynamically reallocs the buffer before sprintf.

RemediationAI

Update Hydra to a build that includes upstream fix commit 9cc84c2 (https://github.com/vanhauser-thc/thc-hydra/commit/9cc84c20e75f5fef6bb1790bb9ada2afad2204e2); this is an upstream fix available as a commit, and a released patched version (9.8-dev or a later tag) should be confirmed before deployment since the provided data does not name a tagged release. Until rebuilt, avoid using Hydra's NTLM authentication option against untrusted or attacker-influenced targets, since the malicious party is the server you point Hydra at - restrict scans to known, trusted endpoints. As a strong compensating control, run Hydra only on hosts with stack-smashing protection and ASLR enabled (for example compiled with -fstack-protector-strong and -D_FORTIFY_SOURCE), which the advisory implies prevents reliable code execution; the trade-off is that an oversized challenge may still crash the process. Running Hydra inside a disposable container or VM further limits blast radius if a crafted challenge is encountered. Refer to the VulnCheck advisory (https://www.vulncheck.com/advisories/hydra-stack-buffer-overflow-in-ntlm-authentication-handler) to confirm the fixed release.