CVE-2026-7598: 
NixOS vulnerability analysis and mitigation

CVE-2026-7598 is an integer overflow vulnerability in libssh2 affecting all versions up to and including 1.11.1. The flaw resides in the userauth_password function within src/userauth.c, where insufficient bounds checking on the username_len and password_len arguments can lead to integer overflow conditions. It was disclosed on May 1, 2026, with the patch merged on April 13, 2026 (commit 256d04b). The vulnerability carries a CVSS v3.1 base score of 7.3 (High) and a CVSS v4.0 base score of 6.9 (Medium) (Github Advisory, Feedly).

The root cause is an integer overflow or wraparound (CWE-190) in the userauth_password function of src/userauth.c. When computing buffer sizes such as username_len + 40 or username_len + password_len + 44, the code failed to validate that these values would not exceed UINT32_MAX, allowing an attacker to supply crafted oversized length values that wrap around and produce an undersized allocation. The fix adds explicit bounds checks — e.g., if(username_len > UINT32_MAX - 40) — before performing arithmetic on these lengths, and also corrects a pre-existing flawed bounds check in the password change path (<= vs. proper subtraction-based comparison). The attack is network-accessible, requires no authentication or user interaction, and has low attack complexity (libssh2 PR #1858, libssh2 commit).

Successful exploitation could result in low-level unauthorized access to sensitive information (confidentiality impact), unauthorized modification of data (integrity impact), and potential service disruption (availability impact). Because libssh2 is a widely embedded SSH library used across many applications, platforms, and distributions — including Ubuntu, Fedora, Amazon Linux, and Windows toolchains — the affected scope is broad. The vulnerability does not appear to enable full remote code execution based on current analysis, but memory corruption resulting from the integer overflow could potentially be leveraged for further exploitation depending on the application context (Github Advisory, Feedly).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). No threat actor attribution has been identified. The EPSS score is approximately 0.046% (Feedly data) to 0.075% (GitHub Advisory), placing it in a low exploitation probability range. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available from Nessus (plugin IDs 311788, 312357, 317985, 319615) and Qualys (288868) (Feedly).

The fix is available as commit 256d04b60d80bf1190e96b0ad1e91b2174d744b1 merged into the libssh2 master branch on April 13, 2026, via PR #1858. Users should update libssh2 to a version built from or after this commit. Distribution-specific patches have been released for Ubuntu (USN-8309-1), Fedora (FEDORA-2026-1b9134cdc9), Amazon Linux 2 (ALAS2-2026-3329), and Amazon Linux 2023 (ALAS2023-2026-1779). Priority should be given to systems running libssh2 versions 1.11.0 and 1.11.1; no configuration-based workaround is available, so patching is the only remediation (libssh2 PR #1858, Github Advisory).

The vulnerability received routine coverage from security aggregators and distribution security teams, including Yocto Project security mailing lists, Red Packet Security, and Linux security advisory sites. Microsoft's Security Response Center published an entry for the CVE. Pro-Linux.de covered it under denial-of-service and buffer overflow categories. No notable researcher commentary or significant social media discussion beyond automated CVE notification accounts has been observed (Feedly).