CVE-2026-4541: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-4541 is an Ed25519 signature malleability vulnerability in janmojzis/tinyssh affecting all versions up to and including 20250501. The flaw resides in tinyssh/crypto_sign_ed25519_tinyssh.c within the built-in Ed25519 signature verifier (the non-lib25519 code path), where the scalar component S of a signature is not checked against the Ed25519 subgroup order L, violating RFC 8032 §5.1.7. It was discovered and reported by researcher py-thok on February 24, 2026, with the fix merged on March 1, 2026, and publicly disclosed via NVD on March 22, 2026. The vulnerability carries a CVSS v3.1 base score of 2.5 (Low) and a CVSS v4.0 base score of 1.1 (Low) (GitHub Issue, ENISA EUVD, Red Hat CVE).

The root cause is classified as CWE-347 (Improper Verification of Cryptographic Signature) and CWE-345 (Insufficient Verification of Data Authenticity). In crypto_sign_ed25519_tinyssh.c at line 77, the verifier only checks if (sm[63] & 224) goto fail; — a partial high-bit check — but never performs a full canonical range check to ensure S < L (the Ed25519 subgroup order). As a result, for any valid signature (R, S), a malleated variant (R, S+L) will also pass verification, since S and S+L produce the same scalar multiplication result modulo L. The attack requires local access and low privileges, and exploitation complexity is rated high because the attacker must craft a malleated signature where the high bits of S+L do not trigger the existing partial check (GitHub Issue, Fix Commit). A public proof-of-concept (poc.c) was included in the original issue report (GitHub Issue).

The primary impact is a low-severity integrity violation: an attacker who can present a crafted SSH authentication message can produce a non-canonical but accepted Ed25519 signature, breaking signature uniqueness. This can cause cross-implementation inconsistencies where strict RFC 8032-compliant verifiers reject signatures that tinyssh accepts, potentially undermining audit logs, replay-detection mechanisms, or higher-level policy logic that relies on canonical signature representation. There is no confidentiality or availability impact, and the vulnerability does not enable remote code execution or authentication bypass in typical SSH usage scenarios (GitHub Issue, ENISA EUVD).

A public proof-of-concept (poc.c) was published alongside the original vulnerability disclosure on February 24, 2026, and is confirmed to work against vulnerable tinyssh builds (GitHub Issue). The CVSS v4.0 exploit maturity is rated PROOF_OF_CONCEPT. The EPSS score is extremely low at 0.000040, indicating a very low probability of widespread exploitation. There is no evidence of in-the-wild exploitation, no threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (ENISA EUVD).

1. Obtain a valid Ed25519 signature: Using a legitimate keypair accepted by the target tinyssh instance, produce a valid signature (R, S) over a chosen message.
2. Compute the malleated scalar: Add the Ed25519 subgroup order L (in little-endian) to S to produce S' = S + L using 32-byte little-endian addition.
3. Filter for passable malleated signatures: Check that the high bits of S'[63] do not set bits in the mask 0xE0 (224), as tinyssh's partial check if (sm[63] & 224) goto fail; would otherwise reject the signature. Retry with a new signature if the condition is not met (typically succeeds within a small number of attempts).
4. Submit the malleated signature: Present the crafted signature (R, S') to the tinyssh verifier. The vulnerable crypto_sign_ed25519_open function accepts it as valid, demonstrating signature malleability.
5. Exploit higher-level logic: Use the accepted non-canonical signature to confuse audit systems, bypass signature-uniqueness checks, or create inconsistencies with strict RFC 8032-compliant verifiers in mixed-implementation environments (GitHub Issue).

Upgrade tinyssh to version 20260301 or later, which includes the fix in commit 9c87269607e0d7d20174df742accc49c042cff17. The patch adds a proper canonical S range check using sc25519_reduce followed by crypto_verify_32 to reject any signature where S >= L before proceeding with scalar multiplication. No configuration-based workaround is available; upgrading is the only remediation (tinyssh Release, Fix Commit).

The tinyssh maintainer (janmojzis) responded promptly to the issue report on February 24, 2026, merging the fix the same day and releasing version 20260301 on March 1, 2026, crediting researcher py-thok in the release notes (tinyssh Release). A blog post by Jericho published March 31, 2026 referenced this CVE in the context of CNA (CVE Numbering Authority) assignment practices, suggesting some community discussion around the CVE's scope and severity classification (Jericho Blog). No significant broader media coverage or notable security researcher commentary beyond the original disclosure was identified.