CVE-2026-7598 libssh2 userauth.c userauth_password integer overflow
A remote attacker can trigger an integer overflow in libssh2's password authentication, potentially causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-7598?
CVE-2026-7598 is a medium-severity vulnerability in libssh2, published on 1 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The name of the patch is 256d04b60d80bf1190e96b0ad1e91b2174d744b1. A patch should be applied to remediate this issue.
Which versions are affected by CVE-2026-7598?
It affects 1 product.
Linux distribution packages (20)
libssh2 Red Hat:hummingbird:1 | All versions | 0:1.11.1-5.1.hum1 |
libssh2-devel Red Hat:hummingbird:1 | All versions | 0:1.11.1-5.1.hum1 |
libssh2-docs Red Hat:hummingbird:1 | All versions | 0:1.11.1-5.1.hum1 |
rust Red Hat:hummingbird:1 | All versions | 0:1.95.0-5.hum1 |
rust-analyzer Red Hat:hummingbird:1 | All versions | 0:1.95.0-5.hum1 |
rust-debugger-common Red Hat:hummingbird:1 | All versions | 0:1.95.0-5.hum1 |
rust-doc Red Hat:hummingbird:1 | All versions | 0:1.95.0-5.hum1 |
rust-gdb Red Hat:hummingbird:1 | All versions | 0:1.95.0-5.hum1 |
rust-lldb Red Hat:hummingbird:1 | All versions | 0:1.95.0-5.hum1 |
rust-src Red Hat:hummingbird:1 | All versions | 0:1.95.0-5.hum1 |
rust-std-static Red Hat:hummingbird:1 | All versions | 0:1.95.0-5.hum1 |
rust-std-static-aarch64-unknown-none-softfloat Red Hat:hummingbird:1 | All versions | 0:1.95.0-5.hum1 |
rust-std-static-aarch64-unknown-uefi Red Hat:hummingbird:1 | All versions | 0:1.95.0-5.hum1 |
rust-std-static-i686-pc-windows-gnu Red Hat:hummingbird:1 | All versions | 0:1.95.0-5.hum1 |
rust-std-static-wasm32-unknown-unknown Red Hat:hummingbird:1 | All versions | 0:1.95.0-5.hum1 |
rust-std-static-wasm32-wasip1 Red Hat:hummingbird:1 | All versions | 0:1.95.0-5.hum1 |
rust-std-static-x86_64-pc-windows-gnu Red Hat:hummingbird:1 | All versions | 0:1.95.0-5.hum1 |
rust-std-static-x86_64-unknown-none Red Hat:hummingbird:1 | All versions | 0:1.95.0-5.hum1 |
rust-std-static-x86_64-unknown-uefi Red Hat:hummingbird:1 | All versions | 0:1.95.0-5.hum1 |
rustfmt Red Hat:hummingbird:1 | All versions | 0:1.95.0-5.hum1 |
Products include Libssh2 Libssh2.
How do I fix CVE-2026-7598?
Apply the vendor's patch.
Is CVE-2026-7598 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-7598 exists.
Other vulnerabilities in libssh2
- CVE-2026-55200 libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c
- CVE-2026-66032 libssh2 Double-Free Heap Corruption via sftp_open()
- CVE-2026-66033 libssh2 Integer Underflow DoS via AES-GCM Cipher Negotiation
- CVE-2026-58050 libssh2 - Integer Overflow in publickey Subsystem Attribute Allocation
- CVE-2026-58051 libssh2 - Free of Uninitialized Pointer in publickey List Cleanup
Sources
Also known as ALPINE-CVE-2026-7598, AZL-85451, AZL-97404, AZL-97431, BELL-CVE-2026-7598, CLSA-2026-1778247114 and 16 more.