PT-2026-26972 · Tinyssh · Tinyssh

Pythok · Published 2026-01-01 · Updated 2026-03-23 · CVE-2026-4541

Positive Technologies (AI Summary)

CVSS v3.1

2.5

Low

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions janmojzis tinyssh versions up to 20250501

Description A flaw exists in the Ed25519 Signature Handler component of tinyssh, specifically within the tinyssh/crypto sign ed25519 tinyssh.c file. This issue causes improper verification of cryptographic signatures. The attack is limited to local execution and is considered difficult to exploit. The vulnerability resides in an unknown function.

Recommendations Upgrade to version 20260301 to address this issue.

Exploit

Fix

Insufficient Verification of Data Authenticity

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-345

CWE-347

Related Identifiers

CVE-2026-4541

Affected Products

Tinyssh

References · 23

• 🔥 https://github.com/janmojzis/tinyssh/issues/101#issue-3983586116 · Exploit
• https://github.com/janmojzis/tinyssh/releases/tag/20260301 · Patch
• https://github.com/janmojzis/tinyssh/commit/9c87269607e0d7d20174df742accc49c042cff17 · Patch
• https://github.com/janmojzis/tinyssh/pull/102 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-4541 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4541 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-4541 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-4541 · Security Note
• https://ubuntu.com/security/CVE-2026-4541 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-4541 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-4541 · Vendor Advisory
• https://github.com/janmojzis/tinyssh/issues/101 · Note
• https://vuldb.com/vuln/352358 · Note
• https://twitter.com/CVEarity/status/2035714440465981536 · Twitter Post
• https://twitter.com/CVEnew/status/2035992544119578852 · Twitter Post