CVE-2026-7598: libssh2 userauth.c userauth_password integer overflow

Synopsis

An integer overflow vulnerability exists in the userauth_password function within src/userauth.c of libssh2 versions up to and including 1.11.1. The flaw is reachable over the network without any authentication or user interaction, meaning an unauthenticated remote attacker can trigger it by sending a malformed username_len or password_len value during the SSH authentication handshake. Successful exploitation enables an attacker to corrupt data integrity and crash the affected service. No upstream fix version has been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable function is exposed over the network during the SSH authentication handshake, so an attacker must be able to reach the service on its SSH port.

• AuthenticationNot required

  The overflow is triggered before any credential is validated, so no account or privilege level is needed to send the malformed input.

• Victim interactionNot required

  No user action is needed; the attacker initiates the malformed authentication request entirely on their own.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or environmental prerequisites.

Blast Radius

• An attacker can overwrite memory structures in the libssh2 process, corrupting persisted or in-flight SSH session state and any data flowing through it.
• Integrity of authentication logic is broken, allowing an attacker to manipulate how credentials or session parameters are processed.
• The integer overflow can cause the process to crash, taking down any application or service that depends on the libssh2 connection for availability.
• Any container or service that uses libssh2 for SSH client functionality (automated deployments, file transfers, remote command execution) is exposed to the same impact.