CVE-2026-7598: libssh2 userauth.c userauth_password integer overflow
A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The name of the patch is 256d04b60d80bf1190e96b0ad1e91b2174d744b1. A patch should be applied to remediate this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7598?
CVE-2026-7598 is classified as a high severity vulnerability due to its potential for leading to remote code execution.
How do I fix CVE-2026-7598?
To fix CVE-2026-7598, upgrade libssh2 to version 1.11.2 or later where the vulnerability is addressed.
What is the impact of CVE-2026-7598 on affected systems?
The impact of CVE-2026-7598 can result in unauthorized access or control over systems using vulnerable versions of libssh2.
Which versions of libssh2 are affected by CVE-2026-7598?
CVE-2026-7598 affects all versions of libssh2 up to and including version 1.11.1.
What does CVE-2026-7598 exploit in libssh2?
CVE-2026-7598 exploits an integer overflow in the userauth_password function due to improper handling of username and password lengths.