CVE-2026-7598

HighCVSS 7.3/10Last modified Nov 11, 2026

Description

A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The name of the patch is 256d04b60d80bf1190e96b0ad1e91b2174d744b1. A patch should be applied to remediate this issue.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-189 CWE-190

Affected software

Vendor	Product	Versions
n/a	libssh2	1.11.0; 1.11.1
Red Hat	Red Hat Hardened Images	—
Red Hat	Red Hat Hardened Images	—
Red Hat	Red Hat Enterprise Linux 6	—
Red Hat	Red Hat Enterprise Linux 7	—
Red Hat	Red Hat OpenShift Container Platform 4	—
Red Hat	Red Hat OpenShift Update Service	—
Red Hat	Red Hat Trusted Profile Analyzer	—

References

https://github.com/libssh2/libssh2/Product
https://github.com/libssh2/libssh2/commit/256d04b60d80bf1190e96b0ad1e91b2174d744b1Patch
https://github.com/libssh2/libssh2/pull/1858Issue Tracking
https://vuldb.com/submit/805564Third Party Advisory, VDB Entry
https://vuldb.com/vuln/360555Third Party Advisory, VDB Entry
https://vuldb.com/vuln/360555/ctiPermissions Required, VDB Entry
https://access.redhat.com/errata/RHSA-2026:16736
https://access.redhat.com/errata/RHSA-2026:61752
https://access.redhat.com/errata/RHSA-2026:7021
https://access.redhat.com/security/cve/CVE-2026-7598
https://bugzilla.redhat.com/show_bug.cgi?id=2464597
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7598.json
https://vuldb.com/submit/805564Third Party Advisory, VDB Entry

Timeline

Published: May 1, 2026
Last modified: Nov 11, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-759806.4The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scr CVE-2026-759817.2The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to unauthenticated Stored Cross-Sit CVE-2026-759824.4The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to, and includi CVE-2026-759837.5The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all CVE-2026-759847.4A vulnerability was detected in TRENDnet TEW-823DRU 1.1.02b01. Impacted is an unknown function of the file /cgi-bin/admin.cgi. The manipulat CVE-2026-759857.4A flaw has been found in TRENDnet Router 1.1.02b01. The affected element is an unknown function of the file /cgi-bin/ping.cgi. This manipula CVE-2026-759867.3A vulnerability has been found in code-projects Online Job Portal System 1.0. The impacted element is an unknown function of the file /ForPa CVE-2026-759877.3A vulnerability was found in SPLWare esProc up to 20260507. This affects the function ObjectInputStream.readUnshared of the file src/main/ja CVE-2026-75996.3A vulnerability was detected in Dayoooun hwpx-mcp 0.2.0. This affects the function save_document/export_to_text/export_to_html of the file m CVE-2026-759908.6Illustrator is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the curr CVE-2026-759918.6Illustrator is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the cu CVE-2026-759927.8Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current