CVE-2026-7598

A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The name of the patch is 256d04b60d80bf1190e96b0ad1e91b2174d744b1. A patch should be applied to remediate this issue.

• CWE-189
• CWE-190
• CWE-190

• https://github.com/libssh2/libssh2/Product
• https://github.com/libssh2/libssh2/commit/256d04b60d80bf1190e96b0ad1e91b2174d744b1Patch
• https://github.com/libssh2/libssh2/pull/1858Issue Tracking
• https://vuldb.com/submit/805564Third Party Advisory, VDB Entry
• https://vuldb.com/vuln/360555Third Party Advisory, VDB Entry
• https://vuldb.com/vuln/360555/ctiPermissions Required, VDB Entry
• https://access.redhat.com/errata/RHSA-2026:16736
• https://access.redhat.com/errata/RHSA-2026:61752
• https://access.redhat.com/errata/RHSA-2026:7021
• https://access.redhat.com/security/cve/CVE-2026-7598
• https://bugzilla.redhat.com/show_bug.cgi?id=2464597
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7598.json
• https://vuldb.com/submit/805564Third Party Advisory, VDB Entry

Published

May 1, 2026

Last Modified

Sep 1, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-75973Improper Authentication vulnerability in Apache Tomcat. When…7.3
• CVE-2026-75975fast-uri is a URI parser for Node.js. Its custom parser for …7.5
• CVE-2026-75976A weakness has been identified in TRENDnet TEW-823DRU 1.1.02…9.9
• CVE-2026-75977The Mang Board WP plugin for WordPress is vulnerable to Miss…8.8
• CVE-2026-75978A security vulnerability has been detected in xianrendzw Eas…6.3
• CVE-2026-75979A vulnerability was found in xianrendzw EasyReport up to 2.0…6.3
• CVE-2026-75980The BetterDocs – AI Documentation, Knowledge Base, Docs, Wik…6.4
• CVE-2026-75981The TranslatePress – Translate Multilingual sites with AI Tr…7.2
• CVE-2026-75982The LearnPress plugin for WordPress is vulnerable to unautho…4.4
• CVE-2026-75983The Eventin – Event Calendar, Tickets, Registration, Booking…7.5
• CVE-2026-75984A vulnerability was detected in TRENDnet TEW-823DRU 1.1.02b0…7.4
• CVE-2026-75985A flaw has been found in TRENDnet Router 1.1.02b01. The affe…7.4