CVE-2026-7598: Libssh2 Integer Overflow RCE Vulnerability

CVE-2026-7598 Overview

CVE-2026-7598 is an integer overflow vulnerability affecting libssh2 versions up to 1.11.1. The flaw resides in the userauth_password function within src/userauth.c. Attackers can trigger the overflow by manipulating the username_len or password_len arguments during SSH user authentication. The vulnerability is remotely exploitable over the network and does not require authentication or user interaction. The libssh2 maintainers have committed a fix referenced by patch hash 256d04b60d80bf1190e96b0ad1e91b2174d744b1, which adds bounds checking on the username_len value. The issue is classified under [CWE-189] (Numeric Errors).

Critical Impact
Remote attackers can trigger an integer overflow during SSH authentication by submitting crafted username or password length values, potentially impacting confidentiality, integrity, and availability of applications linking against vulnerable libssh2 versions.

Affected Products

libssh2 versions up to and including 1.11.1
Applications and SSH clients statically or dynamically linked against vulnerable libssh2 builds
Operating system packages distributing libssh2 1.11.1 or earlier

Discovery Timeline

2026-05-01 - CVE-2026-7598 published to NVD
2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-7598

Vulnerability Analysis

The vulnerability stems from unchecked arithmetic in the userauth_password code path of libssh2. When constructing the user authentication packet, the library computes a buffer length by adding fixed protocol constants to attacker-controlled length fields. Because the additions occur on 32-bit unsigned integers without prior validation, large values cause the result to wrap around. The truncated length is then used for subsequent allocation and copy operations. Applications that pass long usernames or passwords through libssh2, or peer implementations that supply crafted lengths, can drive the function into the overflowing path. The maintainers addressed the issue by validating username_len against UINT32_MAX - 27 before performing the addition.

Root Cause

The root cause is missing pre-arithmetic bounds validation on user-supplied length fields. The expression username_len + 27 is evaluated on 32-bit unsigned types without checking whether the addition fits within the destination type. This is a classic numeric error pattern tracked under [CWE-189]. The same pattern applies to password_len handling in the affected function.

Attack Vector

Exploitation occurs over the network during SSH authentication. An attacker who controls either side of the SSH handshake, or who can influence the values supplied to libssh2's authentication API, can submit length values close to UINT32_MAX. The overflow leads to undersized allocations followed by larger writes, producing memory corruption and potentially affecting confidentiality, integrity, and availability.

         memset(&session->userauth_list_packet_requirev_state, 0,
                sizeof(session->userauth_list_packet_requirev_state));
 
+        if(username_len > UINT32_MAX - 27) {
+            _libssh2_error(session, LIBSSH2_ERROR_PROTO,
+                           "username_len out of bounds");
+            return NULL;
+        }
+
         session->userauth_list_data_len = username_len + 27;
 
         if(session->userauth_list_data) {

Source: libssh2 commit 256d04b — the patch adds an explicit bounds check on username_len before the addition that previously could overflow.

Detection Methods for CVE-2026-7598

Indicators of Compromise

SSH authentication attempts containing abnormally long username or password fields approaching 32-bit length limits
Application crashes or memory corruption signatures in processes linking libssh2.so or libssh2.dll
Repeated LIBSSH2_ERROR_PROTO events after deploying the patched build, suggesting probing for the overflow path

Detection Strategies

Inventory installed libssh2 versions across servers, workstations, and embedded images using software bill of materials data and package managers (dpkg -l libssh2, rpm -q libssh2).
Monitor SSH client and server logs for protocol errors and authentication failures with unusually large field sizes.
Use network monitoring to flag SSH session establishment traffic containing oversized username or password length fields.

Monitoring Recommendations

Enable verbose logging in applications using libssh2 and forward logs to a centralized analytics platform for correlation.
Track process crash telemetry on hosts running SSH-enabled services that depend on libssh2 to surface exploitation attempts.
Subscribe to the libssh2 GitHub repository for ongoing security advisories and follow-up patches.

How to Mitigate CVE-2026-7598

Immediate Actions Required

Upgrade libssh2 to a release that includes commit 256d04b60d80bf1190e96b0ad1e91b2174d744b1 or rebuild from a patched source tree.
Identify all applications statically linked against vulnerable libssh2 builds and rebuild them against the patched library.
Restrict SSH service exposure to trusted networks where feasible until patched binaries are deployed.

Patch Information

The upstream fix is published in the libssh2 repository as commit 256d04b60d80bf1190e96b0ad1e91b2174d744b1, originating from pull request #1858. The patch introduces an explicit check that returns LIBSSH2_ERROR_PROTO when username_len exceeds UINT32_MAX - 27, preventing the overflow. Distribution maintainers should backport this commit into supported package versions. See the vendor commit details for the complete diff.

Workarounds

Enforce input length validation at the application layer before passing username and password values to libssh2 authentication APIs.
Limit acceptable username and password sizes to reasonable protocol values such as 255 bytes within calling code.
Place SSH endpoints behind a network gateway or bastion that drops oversized authentication payloads.

bash

# Verify installed libssh2 version on Debian/Ubuntu
dpkg -l | grep libssh2

# Verify installed libssh2 version on RHEL/Fedora
rpm -q libssh2

# Build libssh2 from patched source
git clone https://github.com/libssh2/libssh2.git
cd libssh2
git checkout 256d04b60d80bf1190e96b0ad1e91b2174d744b1
mkdir build && cd build
cmake .. && make && sudo make install