Every CVE Search/ Get API key

CVE-2026-7598

libssh2 userauth.c userauth_password integer overflow

6.9 MediumFix available

A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The name of the patch is 256d04b60d80bf1190e96b0ad1e91b2174d744b1. A patch should be applied to remediate this issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

0.47%Up 0.4 points since May 2, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.9

libssh2 userauth.c userauth_password integer overflow

A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The name of the patch is 256d04b60d80bf1190e96b0ad1e91b2174d744b1. A patch should be applied to remediate this issue.

Record
CVE-2026-7598
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C
CVSS 3.0
7.3 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C
CVSS 2.0
7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:OF/RC:C
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Weakness
CWE-190, CWE-189, CWE-190
Updated
2026-11-02
EUVDEUVD-2026-26722 6.9

A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The name of the patch is 256d04b60d80bf1190e96b0ad1e91b2174d744b1. A patch should be applied to remediate this issue.

Record
EUVD-2026-26722
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
Updated
2026-11-02
GitHub AdvisoriesGHSA-jhp3-h4hp-2c3p 6.9

A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the...

A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The name of the patch is 256d04b60d80bf1190e96b0ad1e91b2174d744b1. A patch should be applied to remediate this issue.

Record
GHSA-jhp3-h4hp-2c3p
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-190
Updated
2026-11-02
NVD 6.9

A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The name of the patch is 256d04b60d80bf1190e96b0ad1e91b2174d744b1. A patch should be applied to remediate this issue.

Record
CVE-2026-7598
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-189, CWE-190
Updated
2026-11-02
OSVALPINE-CVE-2026-7598 6.9

A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The name of the patch is 256d04b60d80bf1190e96b0ad1e91b2174d744b1. A patch should be applied to remediate this issue.

Record
ALPINE-CVE-2026-7598
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVBELL-CVE-2026-7598 7.3
Record
BELL-CVE-2026-7598
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
Show 33 moreShow less
OSV 6.9

libssh2 userauth.c userauth_password integer overflow

A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The name of the patch is 256d04b60d80bf1190e96b0ad1e91b2174d744b1. A patch should be applied to remediate this issue.

Record
CVE-2026-7598
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
Weakness
CWE-189, CWE-190
Updated
2026-11-02
OSVDEBIAN-CVE-2026-7598 6.9

A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The name of the patch is 256d04b60d80bf1190e96b0ad1e91b2174d744b1. A patch should be applied to remediate this issue.

Record
DEBIAN-CVE-2026-7598
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVJLSEC-2026-492 6.9

A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The name of the patch is 256d04b60d80bf1190e96b0ad1e91b2174d744b1. A patch should be applied to remediate this issue.

Record
JLSEC-2026-492
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVOESA-2026-2336 7.3

libssh2 security update

libssh2 is a library implementing the SSH2 protocol as defined by Internet Drafts: SECSH-TRANS(22), SECSH-USERAUTH(25), SECSH-CONNECTION(23), SECSH-ARCH(20), SECSH-FILEXFER(06)*, SECSH-DHGEX(04), and SECSH-NUMBERS(10).

Security Fix(es):

A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The name of the patch is 256d04b60d80bf1190e96b0ad1e91b2174d744b1. A patch should be applied to remediate this issue.(CVE-2026-7598)

Record
OESA-2026-2336
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVRHSA-2026:16736 9.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:16736
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:61752 9.1

Red Hat Security Advisory: libssh2 security update

Record
RHSA-2026:61752
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:7021 9.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:7021
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-7598 6.9

A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The name of the patch is 256d04b60d80bf1190e96b0ad1e91b2174d744b1. A patch should be applied to remediate this issue.

Record
UBUNTU-CVE-2026-7598
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVAZL-85451 No score

CVE-2026-7598 affecting package libssh2 for versions less than 1.11.1-2

A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The name of the patch is 256d04b60d80bf1190e96b0ad1e91b2174d744b1. A patch should be applied to remediate this issue.

Record
AZL-85451
Updated
2026-11-05
OSVAZL-97404 No score

CVE-2026-7598 affecting package rust for versions less than 1.75.0-30

A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The name of the patch is 256d04b60d80bf1190e96b0ad1e91b2174d744b1. A patch should be applied to remediate this issue.

Record
AZL-97404
Updated
2026-11-05
OSVAZL-97431 No score

CVE-2026-7598 affecting package rust for versions less than 1.96.1-2

A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The name of the patch is 256d04b60d80bf1190e96b0ad1e91b2174d744b1. A patch should be applied to remediate this issue.

Record
AZL-97431
Updated
2026-11-05
OSVCLSA-2026-1778247114 No score

libssh2: Fix of CVE-2026-7598

  • CVE-2026-7598: fix integer overflow in userauth_password (CVE-2026-7598)
Record
CLSA-2026-1778247114
Updated
2026-11-02
OSVCLSA-2026-1778602690 No score

Fix CVE(s): CVE-2026-7598

  • SECURITY UPDATE: fix integer overflow in username_len bounds checks across userauth_list, userauth_password and password change paths in src/userauth.c
    • debian/patches/CVE-2026-7598.patch: fix integer overflow in username_len bounds checks across userauth_list, userauth_password and password change paths in src/userauth.c
    • CVE-2026-7598
Record
CLSA-2026-1778602690
Updated
2026-11-02
OSVCLSA-2026-1778602853 No score

Fix CVE(s): CVE-2026-7598

  • SECURITY UPDATE: fix integer overflow in username_len bounds checks across userauth_list, userauth_password and password change paths in src/userauth.c
    • debian/patches/CVE-2026-7598.patch: fix integer overflow in username_len bounds checks across userauth_list, userauth_password and password change paths in src/userauth.c
    • CVE-2026-7598
Record
CLSA-2026-1778602853
Updated
2026-11-02
OSVCLSA-2026-1778745959 No score

libssh2: Fix of CVE-2026-7598

  • CVE-2026-7598: add username_len/password_len bounds checks in userauth_list() and userauth_password() to prevent integer overflow when allocating the SSH USERAUTH_REQUEST packet buffer
Record
CLSA-2026-1778745959
Updated
2026-11-02
OSVCLSA-2026-1778895374 No score

Fix CVE(s): CVE-2026-7598

  • SECURITY UPDATE: Fix integer overflow in userauth_password username_len/password_len bounds checks
    • debian/patches/CVE-2026-7598.patch: Fix integer overflow in userauth_password username_len/password_len bounds checks
    • CVE-2026-7598
Record
CLSA-2026-1778895374
Updated
2026-11-02
OSVCLSA-2026-1779216196 No score

libssh2: Fix of CVE-2026-7598

  • CVE-2026-7598: fix integer overflow in userauth_password (CVE-2026-7598)
Record
CLSA-2026-1779216196
Updated
2026-11-02
OSVCLSA-2026-1791823540 No score

Fix CVE(s): CVE-2025-15661, CVE-2026-7598

  • SECURITY UPDATE: out-of-bounds heap read in SFTP symlink handling
    • debian/patches/CVE-2025-15661.patch: validate that the link length in a SSH_FXP_NAME response fits within the received packet before copying it in sftp_symlink() in src/sftp.c
    • CVE-2025-15661
Record
CLSA-2026-1791823540
Updated
2026-11-02
OSVMGASA-2026-0273 No score

Updated libssh2 packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Heap Buffer Over-read via sftp_symlink() in sftp.c. (CVE-2025-15661) libssh2 userauth.c userauth_password integer overflow. (CVE-2026-7598) Pre-Authentication DoS via SSH_MSG_EXT_INFO Handler. (CVE-2026-55199) Out-of-Bounds Write via Unchecked packet_length in transport.c. (CVE-2026-55200) Integer Overflow in publickey Subsystem Attribute Allocation. (CVE-2026-58050) Free of Uninitialized Pointer in publickey List Cleanup. (CVE-2026-58051)

Record
MGASA-2026-0273
Updated
2026-11-02
OSVopenSUSE-SU-2026:11109-1 No score

libssh2-1-1.11.1-3.1 on GA media

These are all security issues fixed in the libssh2-1-1.11.1-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11109-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21549-1 No score

Security update for libssh2_org

This update for libssh2_org fixes the following issues:

  • CVE-2025-15661: out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c (bsc#1268546).
  • CVE-2026-7598: integer overflow in function userauth_password of file src/userauth.c (bsc#1263890).
  • CVE-2026-58050: heap buffer overflow due to missing bounds check in attribute count of publickey-subsystem response (bsc#1269568).
  • CVE-2026-58051: uninitialized pointer freed when malformed responses are sent by an SSH server (bsc#1269567).
  • CVE-2026-66032: arbitrary code execution via double-free in SFTP session (bsc#1272737).
  • CVE-2026-66033: denial of service via integer underflow in AES-GCM cipher negotiation (bsc#1272736).
  • CVE-2026-66034: information disclosure and potential arbitrary code execution via heap out-of-bounds read (bsc#1272735).
  • CVE-2026-66035: arbitrary code execution via heap buffer overflow during SSH negotiation (bsc#1272734).
Record
openSUSE-SU-2026:21549-1
Updated
2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2026-7598 No score

CVE-2026-7598 in libssh2 - Patched by Root

Root has patched CVE-2026-7598 in the libssh2 package for Root:Debian:11. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-11-CVE-2026-7598
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2026-7598 No score

CVE-2026-7598 in libssh2 - Patched by Root

Root has patched CVE-2026-7598 in the libssh2 package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2026-7598
Updated
2026-11-02
OSVSUSE-SU-2026:23049-1 No score

Security update for libssh2_org

This update for libssh2_org fixes the following issues:

  • CVE-2025-15661: out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c (bsc#1268546).
  • CVE-2026-7598: integer overflow in function userauth_password of file src/userauth.c (bsc#1263890).
  • CVE-2026-58050: heap buffer overflow due to missing bounds check in attribute count of publickey-subsystem response (bsc#1269568).
  • CVE-2026-58051: uninitialized pointer freed when malformed responses are sent by an SSH server (bsc#1269567).
  • CVE-2026-66032: arbitrary code execution via double-free in SFTP session (bsc#1272737).
  • CVE-2026-66033: denial of service via integer underflow in AES-GCM cipher negotiation (bsc#1272736).
  • CVE-2026-66034: information disclosure and potential arbitrary code execution via heap out-of-bounds read (bsc#1272735).
  • CVE-2026-66035: arbitrary code execution via heap buffer overflow during SSH negotiation (bsc#1272734).
Record
SUSE-SU-2026:23049-1
Updated
2026-11-02
OSVSUSE-SU-2026:23187-1 No score

Security update for libssh2_org

This update for libssh2_org fixes the following issues:

  • CVE-2025-15661: out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c (bsc#1268546).
  • CVE-2026-7598: integer overflow in function userauth_password of file src/userauth.c (bsc#1263890).
  • CVE-2026-55199: pre-authentication DoS via the SSH_MSG_EXT_INFO handler (bsc#1268530).
  • CVE-2026-58050: heap buffer overflow due to missing bounds check in attribute count of publickey-subsystem response (bsc#1269568).
  • CVE-2026-58051: uninitialized pointer freed when malformed responses are sent by an SSH server (bsc#1269567).
  • CVE-2026-66032: arbitrary code execution via double-free in SFTP session (bsc#1272737).
  • CVE-2026-66033: denial of service via integer underflow in AES-GCM cipher negotiation (bsc#1272736).
  • CVE-2026-66034: information disclosure and potential arbitrary code execution via heap out-of-bounds read (bsc#1272735).
  • CVE-2026-66035: arbitrary code execution via heap buffer overflow during SSH negotiation (bsc#1272734).
Record
SUSE-SU-2026:23187-1
Updated
2026-11-02
OSVSUSE-SU-2026:23214-1 No score

Security update for libssh2_org

This update for libssh2_org fixes the following issues:

  • CVE-2025-15661: out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c (bsc#1268546).
  • CVE-2026-7598: integer overflow in function userauth_password of file src/userauth.c (bsc#1263890).
  • CVE-2026-58050: heap buffer overflow due to missing bounds check in attribute count of publickey-subsystem response (bsc#1269568).
  • CVE-2026-58051: uninitialized pointer freed when malformed responses are sent by an SSH server (bsc#1269567).
  • CVE-2026-66032: arbitrary code execution via double-free in SFTP session (bsc#1272737).
  • CVE-2026-66033: denial of service via integer underflow in AES-GCM cipher negotiation (bsc#1272736).
  • CVE-2026-66034: information disclosure and potential arbitrary code execution via heap out-of-bounds read (bsc#1272735).
  • CVE-2026-66035: arbitrary code execution via heap buffer overflow during SSH negotiation (bsc#1272734).
Record
SUSE-SU-2026:23214-1
Updated
2026-11-02
OSVSUSE-SU-2026:23225-1 No score

Security update for libssh2_org

This update for libssh2_org fixes the following issues:

  • CVE-2025-15661: out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c (bsc#1268546).
  • CVE-2026-7598: integer overflow in function userauth_password of file src/userauth.c (bsc#1263890).
  • CVE-2026-58050: heap buffer overflow due to missing bounds check in attribute count of publickey-subsystem response (bsc#1269568).
  • CVE-2026-58051: uninitialized pointer freed when malformed responses are sent by an SSH server (bsc#1269567).
  • CVE-2026-66032: arbitrary code execution via double-free in SFTP session (bsc#1272737).
  • CVE-2026-66033: denial of service via integer underflow in AES-GCM cipher negotiation (bsc#1272736).
  • CVE-2026-66034: information disclosure and potential arbitrary code execution via heap out-of-bounds read (bsc#1272735).
  • CVE-2026-66035: arbitrary code execution via heap buffer overflow during SSH negotiation (bsc#1272734).
Record
SUSE-SU-2026:23225-1
Updated
2026-11-02
OSVSUSE-SU-2026:23245-1 No score

Security update for libssh2_org

This update for libssh2_org fixes the following issues:

Security issues fixed:

  • CVE-2025-15661: out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c (bsc#1268546).
  • CVE-2026-7598: integer overflow in function userauth_password of file src/userauth.c (bsc#1263890).
  • CVE-2026-58050: heap buffer overflow due to missing bounds check in attribute count of publickey-subsystem response (bsc#1269568).
  • CVE-2026-58051: uninitialized pointer freed when malformed responses are sent by an SSH server (bsc#1269567).
  • CVE-2026-66032: arbitrary code execution via double-free in SFTP session (bsc#1272737).
  • CVE-2026-66033: denial of service via integer underflow in AES-GCM cipher negotiation (bsc#1272736).
  • CVE-2026-66034: information disclosure and potential arbitrary code execution via heap out-of-bounds read (bsc#1272735).
  • CVE-2026-66035: arbitrary code execution via heap buffer overflow during SSH negotiation (bsc#1272734).

Other updates and bugfixes:

  • Fix an issue with Encrypt-then-MAC family (bsc#1221622).
    • Test the ETM feature in the remote end's configuration when receiving data. Upstream issue: #1331.
  • Always add the KEX pseudo-methods ext-info-c and [email protected] when configuring custom method list (bsc#1218971).
    • The strict-kex extension is announced in the list of available KEX methods. However, when the default KEX method list is modified or replaced, the extension is not added back automatically.
Record
SUSE-SU-2026:23245-1
Updated
2026-11-02
OSVSUSE-SU-2026:3525-1 No score

Security update for libssh2_org

This update for libssh2_org fixes the following issues:

  • CVE-2025-15661: out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c (bsc#1268546).
  • CVE-2026-7598: integer overflow in function userauth_password of file src/userauth.c (bsc#1263890).
  • CVE-2026-55199: pre-authentication DoS via the SSH_MSG_EXT_INFO handler (bsc#1268530).
  • CVE-2026-58050: heap buffer overflow due to missing bounds check in attribute count of publickey-subsystem response (bsc#1269568).
  • CVE-2026-58051: uninitialized pointer freed when malformed responses are sent by an SSH server (bsc#1269567).
  • CVE-2026-66032: arbitrary code execution via double-free in SFTP session (bsc#1272737).
  • CVE-2026-66033: denial of service via integer underflow in AES-GCM cipher negotiation (bsc#1272736).
  • CVE-2026-66034: information disclosure and potential arbitrary code execution via heap out-of-bounds read (bsc#1272735).
  • CVE-2026-66035: arbitrary code execution via heap buffer overflow during SSH negotiation (bsc#1272734).
Record
SUSE-SU-2026:3525-1
Updated
2026-11-02
OSVSUSE-SU-2026:3526-1 No score

Security update for libssh2_org

This update for libssh2_org fixes the following issues:

  • CVE-2025-15661: out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c (bsc#1268546).
  • CVE-2026-7598: integer overflow in function userauth_password of file src/userauth.c (bsc#1263890).
  • CVE-2026-58050: heap buffer overflow due to missing bounds check in attribute count of publickey-subsystem response (bsc#1269568).
  • CVE-2026-58051: uninitialized pointer freed when malformed responses are sent by an SSH server (bsc#1269567).
  • CVE-2026-66032: arbitrary code execution via double-free in SFTP session (bsc#1272737).
  • CVE-2026-66033: denial of service via integer underflow in AES-GCM cipher negotiation (bsc#1272736).
  • CVE-2026-66034: information disclosure and potential arbitrary code execution via heap out-of-bounds read (bsc#1272735).
  • CVE-2026-66035: arbitrary code execution via heap buffer overflow during SSH negotiation (bsc#1272734).
Record
SUSE-SU-2026:3526-1
Updated
2026-11-02
OSVSUSE-SU-2026:3541-1 No score

Security update for libssh2_org

This update for libssh2_org fixes the following issues:

  • CVE-2025-15661: out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c (bsc#1268546).
  • CVE-2026-7598: integer overflow in function userauth_password of file src/userauth.c (bsc#1263890).
  • CVE-2026-58050: heap buffer overflow due to missing bounds check in attribute count of publickey-subsystem response (bsc#1269568).
  • CVE-2026-58051: uninitialized pointer freed when malformed responses are sent by an SSH server (bsc#1269567).
  • CVE-2026-66032: arbitrary code execution via double-free in SFTP session (bsc#1272737).
  • CVE-2026-66033: denial of service via integer underflow in AES-GCM cipher negotiation (bsc#1272736).
  • CVE-2026-66034: information disclosure and potential arbitrary code execution via heap out-of-bounds read (bsc#1272735).
  • CVE-2026-66035: arbitrary code execution via heap buffer overflow during SSH negotiation (bsc#1272734).
Record
SUSE-SU-2026:3541-1
Updated
2026-11-02
OSVSUSE-SU-2026:4095-1 No score

Security update for libssh2_org

This update for libssh2_org fixes the following issues:

  • CVE-2025-15661: out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c (bsc#1268546).
  • CVE-2026-7598: integer overflow in function userauth_password of file src/userauth.c (bsc#1263890).
  • CVE-2026-58050: attacker controlled attribute count from a publickey-subsystem response is used without bounds checking and can cause to a heap buffer overflow in a connecting libssh2 client (bsc#1269568).
  • CVE-2026-58051: public key list is increased and does not zero-initialized new entries, which can cause an uninitialized pointer to be freed when a malformed response is sent by an SSH server (bsc#1269567).
  • CVE-2026-66032: Arbitrary code execution via double-free in SFTP session (bsc#1272737).
  • CVE-2026-66033: Denial of Service via integer underflow in AES-GCM cipher negotiation (bsc#1272736).
  • CVE-2026-66034: Information disclosure and potential arbitrary code execution via heap out-of-bounds read (bsc#1272735).
  • CVE-2026-66035: Arbitrary code execution via heap buffer overflow during SSH negotiation (bsc#1272734).
Record
SUSE-SU-2026:4095-1
Updated
2026-11-02
OSVUSN-8309-1 No score

libssh2 vulnerability

It was discovered that libssh2 incorrectly handled username and password length values during SSH password authentication. A remote attacker could possibly use this issue to cause a denial of service.

Record
USN-8309-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libssh2
Alpine:v3.20
 before 1.11.0-r3
1.11.0-r3
libssh2
Alpine:v3.21
 before 1.11.1-r1
1.11.1-r1
libssh2
Alpine:v3.22
 before 1.11.1-r1
1.11.1-r1
libssh2
Alpine:v3.23
 before 1.11.1-r2
1.11.1-r2
libssh2
Alpine:v3.24
 before 1.11.1-r2
1.11.1-r2
libssh2
Azure Linux:3
 before 1.11.1-2
1.11.1-2
rust
Azure Linux:3
 before 1.75.0-30
1.75.0-30
rust
Azure Linux:3
 1.85.0 up to 1.96.1-2
1.96.1-2
libssh2
Alpaquita:23
 1.10.0-r4 up to 1.11.1-r1
1.11.1-r1
libssh2
Alpaquita:25
 1.11.1-r0 up to 1.11.1-r1
1.11.1-r1
Show 87 moreShow less
Affected packages
PackageAffectedFixed
libssh2
Alpaquita:stream
 1.10.0-r4 up to 1.11.1-r2
1.11.1-r2
libssh2
TuxCare:CentOS:7
 before 1.8.0-4.el7_9.1.tuxcare.els1
1.8.0-4.el7_9.1.tuxcare.els1
libssh2-devel
TuxCare:CentOS:7
 before 1.8.0-4.el7_9.1.tuxcare.els1
1.8.0-4.el7_9.1.tuxcare.els1
libssh2-docs
TuxCare:CentOS:7
 before 1.8.0-4.el7_9.1.tuxcare.els1
1.8.0-4.el7_9.1.tuxcare.els1
libssh2-1
TuxCare:Ubuntu:16.04
 before 1.5.0-2ubuntu0.1+tuxcare.els5
1.5.0-2ubuntu0.1+tuxcare.els5
libssh2-1-dev
TuxCare:Ubuntu:16.04
 before 1.5.0-2ubuntu0.1+tuxcare.els5
1.5.0-2ubuntu0.1+tuxcare.els5
libssh2-1
TuxCare:Ubuntu:18.04
 before 1.8.0-1ubuntu0.1+tuxcare.els1
1.8.0-1ubuntu0.1+tuxcare.els1
libssh2-1-dev
TuxCare:Ubuntu:18.04
 before 1.8.0-1ubuntu0.1+tuxcare.els1
1.8.0-1ubuntu0.1+tuxcare.els1
libssh2
TuxCare:CentOS:6
 before 1.4.2-3.0.1.el6_10.1.tuxcare.els4
1.4.2-3.0.1.el6_10.1.tuxcare.els4
libssh2-devel
TuxCare:CentOS:6
 before 1.4.2-3.0.1.el6_10.1.tuxcare.els4
1.4.2-3.0.1.el6_10.1.tuxcare.els4
libssh2-docs
TuxCare:CentOS:6
 before 1.4.2-3.0.1.el6_10.1.tuxcare.els4
1.4.2-3.0.1.el6_10.1.tuxcare.els4
libssh2-1
TuxCare:Debian:10
 before 1.8.0-2.1+deb10u1+tuxcare.els1
1.8.0-2.1+deb10u1+tuxcare.els1
libssh2-1-dev
TuxCare:Debian:10
 before 1.8.0-2.1+deb10u1+tuxcare.els1
1.8.0-2.1+deb10u1+tuxcare.els1
libssh2
TuxCare:OracleLinux:7
 before 1.8.0-4.el7_9.1.tuxcare.els1
1.8.0-4.el7_9.1.tuxcare.els1
libssh2-devel
TuxCare:OracleLinux:7
 before 1.8.0-4.el7_9.1.tuxcare.els1
1.8.0-4.el7_9.1.tuxcare.els1
libssh2-docs
TuxCare:OracleLinux:7
 before 1.8.0-4.el7_9.1.tuxcare.els1
1.8.0-4.el7_9.1.tuxcare.els1
libssh2-1
TuxCare:Ubuntu:20.04
From an advisory covering 2 CVEs
 before 1.8.0-2.1ubuntu0.1+tuxcare.els4
1.8.0-2.1ubuntu0.1+tuxcare.els4
libssh2-1-dev
TuxCare:Ubuntu:20.04
From an advisory covering 2 CVEs
 before 1.8.0-2.1ubuntu0.1+tuxcare.els4
1.8.0-2.1ubuntu0.1+tuxcare.els4
libssh2
Debian:12
 before 1.10.0-3+deb12u1, plus listed versions
1.10.0-3
1.10.0-3+deb12u1
libssh2
Debian:13
 before 1.11.1-1+deb13u1, plus listed versions
1.11.1-1
1.11.1-1+deb13u1
libssh2
Debian:14
 before 1.11.1-3, plus listed versions
1.11.1-11.11.1-2
1.11.1-3
LibSSH2_jll
Julia
 before 1.11.101+0
1.11.101+0
libssh2
Mageia:10
From an advisory covering 6 CVEs
 before 1.11.1-2.1.mga10
1.11.1-2.1.mga10
libssh2
Mageia:9
From an advisory covering 6 CVEs
 before 1.11.0-1.1.mga9
1.11.0-1.1.mga9
libssh2
openEuler:22.03-LTS-SP4
 before 1.10.0-8.oe2203sp4
1.10.0-8.oe2203sp4
libssh2
openEuler:24.03-LTS
 before 1.11.0-6.oe2403sp3
1.11.0-6.oe2403sp3
libssh2
openEuler:24.03-LTS-SP1
 before 1.11.0-6.oe2403sp1
1.11.0-6.oe2403sp1
libssh2
openEuler:24.03-LTS-SP3
 before 1.11.0-6.oe2403sp3
1.11.0-6.oe2403sp3
libssh2
openEuler:20.03-LTS-SP4
 before 1.9.0-10.oe2003sp4
1.9.0-10.oe2003sp4
rust
Red Hat:hummingbird:1
 before 0:1.95.0-5.hum1
0:1.95.0-5.hum1
rust-analyzer
Red Hat:hummingbird:1
 before 0:1.95.0-5.hum1
0:1.95.0-5.hum1
rust-debugger-common
Red Hat:hummingbird:1
 before 0:1.95.0-5.hum1
0:1.95.0-5.hum1
rust-doc
Red Hat:hummingbird:1
 before 0:1.95.0-5.hum1
0:1.95.0-5.hum1
rust-gdb
Red Hat:hummingbird:1
 before 0:1.95.0-5.hum1
0:1.95.0-5.hum1
rust-lldb
Red Hat:hummingbird:1
 before 0:1.95.0-5.hum1
0:1.95.0-5.hum1
rust-src
Red Hat:hummingbird:1
 before 0:1.95.0-5.hum1
0:1.95.0-5.hum1
rust-std-static
Red Hat:hummingbird:1
 before 0:1.95.0-5.hum1
0:1.95.0-5.hum1
rust-std-static-aarch64-unknown-none-softfloat
Red Hat:hummingbird:1
 before 0:1.95.0-5.hum1
0:1.95.0-5.hum1
rust-std-static-aarch64-unknown-uefi
Red Hat:hummingbird:1
 before 0:1.95.0-5.hum1
0:1.95.0-5.hum1
rust-std-static-i686-pc-windows-gnu
Red Hat:hummingbird:1
 before 0:1.95.0-5.hum1
0:1.95.0-5.hum1
rust-std-static-wasm32-unknown-unknown
Red Hat:hummingbird:1
 before 0:1.95.0-5.hum1
0:1.95.0-5.hum1
rust-std-static-wasm32-wasip1
Red Hat:hummingbird:1
 before 0:1.95.0-5.hum1
0:1.95.0-5.hum1
rust-std-static-x86_64-pc-windows-gnu
Red Hat:hummingbird:1
 before 0:1.95.0-5.hum1
0:1.95.0-5.hum1
rust-std-static-x86_64-unknown-none
Red Hat:hummingbird:1
 before 0:1.95.0-5.hum1
0:1.95.0-5.hum1
rust-std-static-x86_64-unknown-uefi
Red Hat:hummingbird:1
 before 0:1.95.0-5.hum1
0:1.95.0-5.hum1
rustfmt
Red Hat:hummingbird:1
 before 0:1.95.0-5.hum1
0:1.95.0-5.hum1
libssh2
Red Hat:rhel_els:7
From an advisory covering 4 CVEs
 before 0:1.8.0-4.el7_9.2
0:1.8.0-4.el7_9.2
libssh2-devel
Red Hat:rhel_els:7
From an advisory covering 4 CVEs
 before 0:1.8.0-4.el7_9.2
0:1.8.0-4.el7_9.2
libssh2
Red Hat:hummingbird:1
 before 0:1.11.1-5.1.hum1
0:1.11.1-5.1.hum1
libssh2-devel
Red Hat:hummingbird:1
 before 0:1.11.1-5.1.hum1
0:1.11.1-5.1.hum1
libssh2-docs
Red Hat:hummingbird:1
 before 0:1.11.1-5.1.hum1
0:1.11.1-5.1.hum1
libssh2
Root:Debian:11
 before 1.9.0-2+deb11u1.aikido.4
1.9.0-2+deb11u1.aikido.41.9.0-2+deb11u1.root.io.11.9.0-2+deb11u1.aikido.51.9.0-2+deb11u1.root.io.21.9.0-2+deb11u1.root.io.3
rootio-libssh2
Root:Debian:11
 before 1.9.0-2+deb11u1.aikido.4
1.9.0-2+deb11u1.aikido.41.9.0-2+deb11u1.root.io.11.9.0-2+deb11u1.aikido.51.9.0-2+deb11u1.root.io.21.9.0-2+deb11u1.root.io.3
libssh2_org
SUSE:Linux Micro 6.2
From an advisory covering 8 CVEs
 before 1.11.1-160000.5.1
1.11.1-160000.5.1
libssh2_org
SUSE:Linux Micro 6.1
From an advisory covering 9 CVEs
 before 1.11.0-slfo.1.1_2.1
1.11.0-slfo.1.1_2.1
libssh2_org
SUSE:Linux Enterprise Server 16.0
From an advisory covering 8 CVEs
 before 1.11.1-160000.5.1
1.11.1-160000.5.1
libssh2_org
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 8 CVEs
 before 1.11.1-160000.5.1
1.11.1-160000.5.1
libssh2_org
SUSE:Linux Micro 6.0
From an advisory covering 8 CVEs
 before 1.11.0-4.1
1.11.0-4.1
libssh2_org
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 9 CVEs
 before 1.11.0-29.18.1
1.11.0-29.18.1
libssh2_org
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 9 CVEs
 before 1.11.0-29.18.1
1.11.0-29.18.1
libssh2_org
SUSE:Linux Enterprise Micro 5.3
From an advisory covering 8 CVEs
 before 1.11.0-150200.9.8.1
1.11.0-150200.9.8.1
libssh2_org
SUSE:Linux Enterprise Micro 5.4
From an advisory covering 8 CVEs
 before 1.11.0-150200.9.8.1
1.11.0-150200.9.8.1
libssh2_org
SUSE:Linux Enterprise Micro 5.5
From an advisory covering 8 CVEs
 before 1.11.0-150200.9.8.1
1.11.0-150200.9.8.1
libssh2_org
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 8 CVEs
 before 1.11.0-150200.9.8.1
1.11.0-150200.9.8.1
libssh2_org
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 8 CVEs
 before 1.11.0-150200.9.8.1
1.11.0-150200.9.8.1
libssh2_org
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 8 CVEs
 before 1.11.0-150200.9.8.1
1.11.0-150200.9.8.1
libssh2_org
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 8 CVEs
 before 1.11.0-150200.9.8.1
1.11.0-150200.9.8.1
libssh2_org
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 8 CVEs
 before 1.11.0-150200.9.8.1
1.11.0-150200.9.8.1
libssh2_org
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 8 CVEs
 before 1.11.0-150200.9.8.1
1.11.0-150200.9.8.1
libssh2_org
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 8 CVEs
 before 1.11.0-150200.9.8.1
1.11.0-150200.9.8.1
libssh2_org
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 8 CVEs
 before 1.11.0-150200.9.8.1
1.11.0-150200.9.8.1
libssh2_org
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 8 CVEs
 before 1.11.0-150600.20.6.1
1.11.0-150600.20.6.1
libssh2_org
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 8 CVEs
 before 1.11.0-150600.20.6.1
1.11.0-150600.20.6.1
libssh2_org
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 8 CVEs
 before 1.11.0-150600.20.6.1
1.11.0-150600.20.6.1
libssh2_org
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 8 CVEs
 before 1.11.0-150000.4.35.1
1.11.0-150000.4.35.1
libssh2_org
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 8 CVEs
 before 1.11.0-150000.4.35.1
1.11.0-150000.4.35.1
libssh2_org
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 8 CVEs
 before 1.11.0-150000.4.35.1
1.11.0-150000.4.35.1
libssh2
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.4.3-11.4.3-21.4.3-2ubuntu0.11.4.3-2ubuntu0.21.4.3-2ubuntu0.2+esm11.4.3-2ubuntu0.2+esm21.4.3-2ubuntu0.2+esm31.4.3-2ubuntu0.2+esm4
 None known
libssh2
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.5.0-21.5.0-2ubuntu0.11.5.0-2ubuntu0.1+esm11.5.0-2ubuntu0.1+esm21.5.0-2ubuntu0.1+esm3
 None known
libssh2
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.8.0-11.8.0-1ubuntu0.11.8.0-1ubuntu0.1+esm1
 None known
libssh2
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.8.0-2.1build11.8.0-2.1ubuntu0.11.8.0-2.1ubuntu0.1+esm1
 None known
libssh2
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.9.0-31.10.0-21.10.0-2build11.10.0-31.10.0-3ubuntu0.1
 None known
libssh2
Ubuntu:24.04:LTS
 before 1.11.0-4.1ubuntu0.24.04.1, plus listed versions
1.11.0-21.11.0-31.11.0-41.11.0-4.1build11.11.0-4.1build2
1.11.0-4.1ubuntu0.24.04.1
libssh2
Ubuntu:25.10
 before 1.11.1-1ubuntu0.25.10.1, plus listed versions
1.11.1-11.11.1-1build1
1.11.1-1ubuntu0.25.10.1
libssh2
Ubuntu:26.04:LTS
 before 1.11.1-1ubuntu0.26.04.1, plus listed versions
1.11.1-1build11.11.1-1build2
1.11.1-1ubuntu0.26.04.1
libssh2_org
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 1.11.1-3.1
1.11.1-3.1
libssh2_org
openSUSE:Leap 16.0
From an advisory covering 8 CVEs
 before 1.11.1-160000.5.1
1.11.1-160000.5.1

History

History
RecordedChangedSources
affected
factsOSV
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-7598 is a medium vulnerability (CVSS 6.9) in Libssh2, published May 1, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 40th percentile. Fixed in libssh2 1.11.0-r3.

References

Show 90 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open