Skip to content
OpenAdvisories
Medium ALAS2-2026-3329 1 CVE

Moderate: libssh2 security update (Amazon Linux 2)

Published Jun 8, 2026 · Updated Jun 8, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-7598: A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The name of the patch is 256d04b60d80bf1190e96b0ad1e91b2174d744b1. A patch should be applied to remediate this issue.

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2 libssh2 0:1.4.3-12.amzn2.2.7
Amazon Linux · 2 libssh2-debuginfo 0:1.4.3-12.amzn2.2.7
Amazon Linux · 2 libssh2-devel 0:1.4.3-12.amzn2.2.7
Amazon Linux · 2 libssh2-docs 0:1.4.3-12.amzn2.2.7

Vulnerabilities 1

  • High 7.3
    CVE-2026-7598

    libssh2 userauth.c userauth_password integer overflow

    A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be lau…

    rust libssh2 libssh2 libssh2 Debian Ubuntu Azure Linux Alpine Wolfi

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-7598.html