{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-7598", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-05-01T10:45:11.583Z", "datePublished": "2026-05-01T21:30:11.006Z", "dateUpdated": "2026-09-01T12:04:41.573Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-05-01T21:30:11.006Z" }, "title": "libssh2 userauth.c userauth_password integer overflow", "problemTypes": [ { "descriptions": [ { "type": "CWE", "cweId": "CWE-190", "lang": "en", "description": "Integer Overflow" } ] }, { "descriptions": [ { "type": "CWE", "cweId": "CWE-189", "lang": "en", "description": "Numeric Error" } ] } ], "affected": [ { "vendor": "n/a", "product": "libssh2", "versions": [ { "version": "1.11.0", "status": "affected" }, { "version": "1.11.1", "status": "affected" } ], "cpes": [ "cpe:2.3:a:libssh2:libssh2:*:*:*:*:*:*:*:*" ] } ], "descriptions": [ { "lang": "en", "value": "A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The name of the patch is 256d04b60d80bf1190e96b0ad1e91b2174d744b1. A patch should be applied to remediate this issue." } ], "metrics": [ { "cvssV4_0": { "version": "4.0", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X", "baseSeverity": "MEDIUM" } }, { "cvssV3_1": { "version": "3.1", "baseScore": 7.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C", "baseSeverity": "HIGH" } }, { "cvssV3_0": { "version": "3.0", "baseScore": 7.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C", "baseSeverity": "HIGH" } }, { "cvssV2_0": { "version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:OF/RC:C" } } ], "timeline": [ { "time": "2026-05-01T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed" }, { "time": "2026-05-01T02:00:00.000Z", "lang": "en", "value": "VulDB entry created" }, { "time": "2026-05-01T12:50:16.000Z", "lang": "en", "value": "VulDB entry last update" } ], "credits": [ { "lang": "en", "value": "dapickle (VulDB User)", "type": "reporter" } ], "references": [ { "url": "https://vuldb.com/vuln/360555", "name": "VDB-360555 | libssh2 userauth.c userauth_password integer overflow", "tags": [ "vdb-entry", "technical-description" ] }, { "url": "https://vuldb.com/vuln/360555/cti", "name": "VDB-360555 | CTI Indicators (IOB, IOC, IOA)", "tags": [ "signature", "permissions-required" ] }, { "url": "https://vuldb.com/submit/805564", "name": "Submit #805564 | libssh2 <= 1.11.1 Integer Overflow", "tags": [ "third-party-advisory" ] }, { "url": "https://github.com/libssh2/libssh2/pull/1858", "tags": [ "issue-tracking", "patch" ] }, { "url": "https://github.com/libssh2/libssh2/commit/256d04b60d80bf1190e96b0ad1e91b2174d744b1", "tags": [ "patch" ] }, { "url": "https://github.com/libssh2/libssh2/", "tags": [ "product" ] } ], "tags": [ "x_open-source" ] }, "adp": [ { "references": [ { "url": "https://vuldb.com/submit/805564", "tags": [ "exploit" ] } ], "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2026-05-04T13:31:33.083934Z", "id": "CVE-2026-7598", "options": [ { "Exploitation": "poc" }, { "Automatable": "yes" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-04T13:31:37.545Z" } }, { "affected": [ { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:hummingbird:1" ], "defaultStatus": "affected", "packageName": "rust-main", "product": "Red Hat Hardened Images", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1.95.0-5.hum1", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:hummingbird:1" ], "defaultStatus": "affected", "packageName": "libssh2-main", "product": "Red Hat Hardened Images", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "1.11.1-5.1.hum1", "versionType": "rpm" } ] }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:6" ], "defaultStatus": "affected", "packageName": "libssh2", "product": "Red Hat Enterprise Linux 6", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/o:redhat:enterprise_linux:7" ], "defaultStatus": "affected", "packageName": "libssh2", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openshift:4" ], "defaultStatus": "unaffected", "packageName": "conmon-rs", "product": "Red Hat OpenShift Container Platform 4", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:openshift_update_service:5" ], "defaultStatus": "unaffected", "packageName": "openshift-update-service/openshift-update-service-rhel8", "product": "Red Hat OpenShift Update Service", "vendor": "Red Hat" }, { "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": [ "cpe:/a:redhat:trusted_profile_analyzer:2" ], "defaultStatus": "affected", "packageName": "rhtpa/rhtpa-trustification-service-rhel9", "product": "Red Hat Trusted Profile Analyzer", "vendor": "Red Hat" } ], "datePublic": "2026-05-01T21:30:11.006Z", "descriptions": [ { "lang": "en", "value": "A flaw was found in the libssh2 library. A remote attacker can exploit an integer overflow vulnerability in the `userauth_password` function by manipulating the `username_len` or `password_len` arguments and cause a heap-based buffer overflow. This leads to a crash to the application linked to the library and potentially allows arbitrary code execution." } ], "metrics": [ { "other": { "content": { "namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important" }, "type": "Red Hat severity rating" } }, { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1" }, "format": "CVSS" } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-190", "description": "Integer Overflow or Wraparound", "lang": "en", "type": "CWE" } ] } ], "references": [ { "tags": [ "vdb-entry", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/security/cve/CVE-2026-7598" }, { "name": "RHBZ#2464597", "tags": [ "issue-tracking", "x_refsource_REDHAT" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464597" }, { "tags": [ "x_sadp-csaf-vex" ], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7598.json" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:61752" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:7021" }, { "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2026:16736" } ], "solutions": [ { "lang": "en", "value": "RHSA-2026:61752: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS)" }, { "lang": "en", "value": "RHSA-2026:7021: Red Hat Hardened Images" }, { "lang": "en", "value": "RHSA-2026:16736: Red Hat Hardened Images" } ], "timeline": [ { "lang": "en", "time": "2026-05-01T22:00:54.329Z", "value": "Reported to Red Hat." }, { "lang": "en", "time": "2026-05-01T21:30:11.006Z", "value": "Made public." } ], "title": "libssh2: integer overflow via large username or password arguments", "workarounds": [ { "lang": "en", "value": "To mitigate this flaw, applications linked to the libssh2 library should be configured or updated to exclusively use public key authentication. Explicitly disabling password-based logins prevents the application from executing the vulnerable userauth_password function." } ], "x_adpType": "supplier", "x_generator": { "engine": "sadp-cli 1.0.0" }, "providerMetadata": { "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-09-01T12:04:41.573Z" } } ] } }