A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The name of the patch is 256d04b60d80bf1190e96b0ad1e91b2174d744b1. A patch should be applied to remediate this issue.
CVSS Details
- CVSS 4.0 Base Score: 6.9 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libssh2 | Jun 2, 2026 | May 1, 2026 |
| Amazon Linux Ami 2 | — | Upgrade libssh2-debuginfoUpgrade libssh2Upgrade libssh2-docsUpgrade libssh2-devel | Jun 9, 2026 | Jun 9, 2026 |
| Amazon_linux_2023 | — | Upgrade libssh2Upgrade libssh2-docsUpgrade rust-cargo-c-debugsourceUpgrade cargo-cUpgrade libssh2-debugsourceUpgrade libssh2-develUpgrade cargo-c-debuginfoUpgrade libssh2-debuginfo | Jun 9, 2026 | May 1, 2026 |
| Debian | — | Upgrade libssh2 | Jul 23, 2026 | Jul 23, 2026 |
| Gentoo Linux | — | Upgrade net-libs/libssh2. | Aug 20, 2026 | Aug 20, 2026 |
| Redhat_linux | — | Upgrade libssh2Upgrade libssh2-docsUpgrade libssh2-debuginfoNo solution existsUpgrade libssh2-devel | Jul 17, 2026 | May 1, 2026 |
| Ubuntu | — | Upgrade libssh2-1t64 | May 27, 2026 | May 26, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jun 18, 2026 | May 1, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub