CVE-2026-7598

HIGH

A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The name of the patch is 256d04b60d80bf1190e96b0ad1e91b2174d744b1. A patch should be applied to remediate this issue.

CVSS v3.1 Score

7.3
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
LOW
Published: 5/1/2026Modified: 9/1/2026

Related Intelligence (1)

CRITICALAi

Patch Tuesday - May 2026

Microsoft is publishing 137 vulnerabilities on May 2026 Patch Tuesday . Microsoft is not aware of exploitation in the wild or public disclosure for any of these vulnerabilities. So far this month, Microsoft has provided patches to address 133 browser vulnerabilities, which are not included in the Patch Tuesday count above. Windows Netlogon: critical RCE Anyone responsible for securing a domain con

CVE-2026-41089CVE-2020-1472
Rapid7

References (13)

https://github.com/libssh2/libssh2/Producthttps://github.com/libssh2/libssh2/commit/256d04b60d80bf1190e96b0ad1e91b2174d744b1Patchhttps://github.com/libssh2/libssh2/pull/1858Issue Trackinghttps://vuldb.com/submit/805564Third Party AdvisoryVDB Entryhttps://vuldb.com/vuln/360555Third Party AdvisoryVDB Entryhttps://vuldb.com/vuln/360555/ctiPermissions RequiredVDB Entryhttps://access.redhat.com/errata/RHSA-2026:16736https://access.redhat.com/errata/RHSA-2026:61752https://access.redhat.com/errata/RHSA-2026:7021https://access.redhat.com/security/cve/CVE-2026-7598https://bugzilla.redhat.com/show_bug.cgi?id=2464597https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7598.jsonhttps://vuldb.com/submit/805564Third Party AdvisoryVDB Entry