CVE-2026-7598

Publication date 1 May 2026

Last updated 27 May 2026

Ubuntu priority

Cvss 3 Severity Score

Description

A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The name of the patch is 256d04b60d80bf1190e96b0ad1e91b2174d744b1. A patch should be applied to remediate this issue.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
libssh2	26.04 LTS resolute	Fixed 1.11.1-1ubuntu0.26.04.1
	25.10 questing	Fixed 1.11.1-1ubuntu0.25.10.1
	24.04 LTS noble	Fixed 1.11.0-4.1ubuntu0.24.04.1
	22.04 LTS jammy	Needs evaluation
	20.04 LTS focal	Needs evaluation
	18.04 LTS bionic	Needs evaluation
	16.04 LTS xenial	Ignored end of ESM support, was needs-triage
	14.04 LTS trusty	Needs evaluation

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
libssh2	Upstream: 256d04b

Severity score breakdown

Parameter	Value
Base score	7.3 · High
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	Low
Integrity impact	Low
Availability impact	Low
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References

Related Ubuntu Security Notices (USN)

USN-8309-1
libssh2 vulnerability
26 May 2026