Description
Hydra through 9.7, fixed in commit 9cc84c2, contains a stack buffer overflow in NTLM authentication across SMTP, POP3, IMAP, NNTP, HTTP, HTTP-Proxy, and HTTP-Proxy-Urlenum modules when processing malicious NTLM Type-2 challenges. A malicious server can send a crafted NTLM Type-2 challenge with an excessively long domain string, causing base64-encoded response data to overflow a 500-byte stack buffer by 18 to 330 bytes, enabling remote code execution on systems without stack protection.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| vanhauser-thc | thc-hydra | ≤ 9.7 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | hydra | No fix yet | — |
| Ubuntu 26.04 LTS | hydra | No fix yet | — |
| Ubuntu 25.10 | hydra | No fix yet | — |
| Ubuntu 24.04 LTS | hydra | No fix yet | — |
| Ubuntu 22.04 LTS | hydra | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | hydra | No fix yet | — |
| Ubuntu 18.04 LTS | hydra | No fix yet | — |
| Ubuntu 16.04 LTS | hydra | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | hydra | 9.7+git20.gbccaea1-1.1 | openSUSE-SU-2026:11131-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Hydra - Stack Buffer Overflow EDB-52622 · remote · Jul 7, 2026
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- openSUSE-SU-2026:11131-1 hydra-9.7+git20.gbccaea1-1.1 on GA media SUSE / openSUSE Security Updates · Jun 29, 2026
References
- Patch Commit patch
- https://www.vulncheck.com/advisories/hydra-stack-buffer-overflow-in-ntlm-authentication-handler third-party-advisory