CVE-2026-56766

Hydra - Stack Buffer Overflow in NTLM Authentication Handler

8.6 HighPublic exploitFix available

Hydra through 9.7, fixed in commit 9cc84c2, contains a stack buffer overflow in NTLM authentication across SMTP, POP3, IMAP, NNTP, HTTP, HTTP-Proxy, and HTTP-Proxy-Urlenum modules when processing malicious NTLM Type-2 challenges. A malicious server can send a crafted NTLM Type-2 challenge with an excessively long domain string, causing base64-encoded response data to overflow a 500-byte stack buffer by 18 to 330 bytes, enabling remote code execution on systems without stack protection.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Active

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

2.44%Up 2.0 points since Jun 26, 2026

What each source reports

CVE List Score used 8.6

Hydra - Stack Buffer Overflow in NTLM Authentication Handler

Record: CVE-2026-56766
CVSS 4.0: 8.6 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-121
Updated: 2026-11-02

EUVDEUVD-2026-39515 8.6

Record: EUVD-2026-39515
CVSS 4.0: 8.6 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-3r6x-6cp5-6575 8.6

Hydra through 9.7, fixed in commit 9cc84c2, contains a stack buffer overflow in NTLM...

Record: GHSA-3r6x-6cp5-6575
CVSS 4.0: 8.6 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-121
Updated: 2026-11-02

NVD 8.6

Record: CVE-2026-56766
CVSS 4.0: 8.6 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-121
Updated: 2026-11-02

OSV 8.6

Hydra - Stack Buffer Overflow in NTLM Authentication Handler

Record: CVE-2026-56766
CVSS 4.0: 8.6 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness: CWE-121
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-56766 8.6

Record: UBUNTU-CVE-2026-56766
CVSS 4.0: 8.6 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVopenSUSE-SU-2026:11131-1 No score

hydra-9.7+git20.gbccaea1-1.1 on GA media

These are all security issues fixed in the hydra-9.7+git20.gbccaea1-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:11131-1
Updated: 2026-11-02

Affected products

vanhauser-thc thc-hydra

Affected packages

Affected packages
Package	Affected	Fixed
`hydra` Ubuntu:16.04:LTS	All versions, plus listed versions 8.1-18.1-1build18.1-1build2	None known
`hydra` Ubuntu:18.04:LTS	All versions, plus listed versions 8.6-18.6-1build1	None known
`hydra` Ubuntu:20.04:LTS	All versions, plus listed versions 9.0-1build1	None known
`hydra` Ubuntu:22.04:LTS	All versions, plus listed versions 9.1-19.2-19.2-1ubuntu1	None known
`hydra` Ubuntu:24.04:LTS	All versions, plus listed versions 9.5-19.5-1build19.5-1build3	None known
`hydra` Ubuntu:25.10	All versions, plus listed versions 9.5-3build1	None known
`hydra` Ubuntu:26.10	All versions, plus listed versions 9.6-39.7-19.7-1build19.7-2	None known
`hydra` Ubuntu:26.04:LTS	All versions, plus listed versions 9.5-3build19.6-3	None known
`hydra` openSUSE:Tumbleweed	before 9.7+git20.gbccaea1-1.1	9.7+git20.gbccaea1-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Hydra - Stack Buffer Overflow	2026-07-07

History

History
Recorded	Changed	Sources
Nov 2, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-56766 is a high vulnerability (CVSS 8.6) in Vanhauser-thc Thc-hydra, published June 25, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.44%, the 84th percentile. Fixed in hydra 9.7+git20.gbccaea1-1.1.