Fail2ban EUVD-2026-98268

The target must run fail2ban 0.10.5 through 1.1.1 (before commit ddd879d) with the default sshd filter (config/filter.d/sshd.conf) active and an sshd jail configured to ban on failed logins against OpenSSH logs - the description states the default filter mode is affected, so no non-default configuration is needed. No authentication is required (PR:N): the attacker only needs network reachability to the SSH service to submit a crafted username like 'x VICTIM-SOURCE-IP on'. Limiting factors that reduce real-world impact: the host must actually deploy vulnerable fail2ban with the sshd jail enabled (common on internet-facing Linux but not universal), and the practical damage is bounded by fail2ban's ban action (e.g., temporary firewall block) and bantime, yielding denial-of-service rather than system compromise.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3 Medium) describes a cleanly remote, low-complexity, unauthenticated issue whose only impact is availability - there is no confidentiality or integrity loss to the host. This is a log-injection (CWE-117) weakness, not code execution: the real-world consequence is a denial-of-service in which an attacker coerces fail2ban into banning an attacker-chosen source IP, which can lock out legitimate administrators or users. No EPSS score was supplied, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public exploit identified at time of analysis - the patch commit includes only a test-case log line, which is not a weaponized POC. Net assessment: this is a genuine, easily triggered abuse-of-functionality bug against a very common defensive tool, but its ceiling is disruption (self-inflicted lockout / blocking a target's IP), not compromise, so it is a real but moderate operational priority rather than a critical emergency. One signal conflict to note: the input tag 'Information Disclosure' contradicts the CVSS impact profile (C:N, A:L), which indicates availability denial, not disclosure.

A remote unauthenticated attacker connects to a target running OpenSSH protected by vulnerable fail2ban with the default sshd filter, and offers a login username crafted as 'x VICTIM-IP on'. OpenSSH logs the offered username verbatim, and the overly permissive filter regex parses the embedded 'VICTIM-IP on' as the host/suffix, so fail2ban attributes the failed attempts to VICTIM-IP and bans it - blocking a legitimate user or administrator. No public exploit is identified, though the patch's test fixture demonstrates the exact injection string.