Critical Vulnerabilities in Fedora libssh2 and NASM Addressed

Severity: High (Score: 70.5)

Sources: Linuxsecurity

Published: 2026-06-07 · Updated: 2026-06-07

Keywords: fedora, important, heap, overflow, cve-2026, dominik, mierzejewski

Severity indicators: heap overflow

Summary

Fedora has released updates addressing two critical vulnerabilities: CVE-2026-7598 and CVE-2026-6067. CVE-2026-7598 is a heap buffer overflow in libssh2 that can be exploited remotely by providing excessively long username or password strings. This vulnerability was published on May 1, 2026, and affects multiple Fedora versions. CVE-2026-6067, published on April 10, 2026, allows arbitrary code execution through malicious assembly file processing in NASM. Both vulnerabilities have been patched, and users are advised to update their systems using the 'dnf' package manager. The updates were confirmed by Fedora's release engineering team, ensuring that affected systems can mitigate these risks effectively. Key Points: • CVE-2026-7598 allows remote exploitation via long username/password strings in libssh2. • CVE-2026-6067 enables arbitrary code execution through malicious assembly files in NASM. • Both vulnerabilities have been patched; users should update their systems immediately.

Detailed Analysis

**Impact** Users of Fedora 42, 43, and 44 are affected by vulnerabilities in libssh2 and NASM components. The libssh2 flaw (CVE-2026-7598) allows remote heap buffer overflow via large username or password inputs, potentially impacting systems relying on SSH authentication. The NASM vulnerability (CVE-2026-6067) enables arbitrary code execution through malicious assembly file processing, affecting development and build environments. No specific sectors or geographies are detailed in the sources. **Technical Details** CVE-2026-7598 in libssh2 is an integer overflow leading to a heap buffer overflow triggered remotely by oversized username or password strings during SSH authentication. CVE-2026-6067 in NASM permits arbitrary code execution when processing crafted assembly files. Both vulnerabilities were addressed in Fedora updates: libssh2 updated to version 1.11.1-6 and NASM to 3.01-3. No malware, tools, or IOCs are mentioned. Attack vectors involve remote authentication attempts and malicious file processing, corresponding to initial access and execution stages of the kill chain. **Recommended Response** Apply Fedora updates immediately using the commands: `dnf upgrade --advisory FEDORA-2026-1b9134cdc9` for libssh2 and `dnf upgrade --advisory FEDORA-2026-eaae48ece0` for NASM. Monitor SSH authentication logs for abnormal username or password lengths and audit assembly file inputs in build environments. Harden SSH configurations to limit login attempts and restrict assembly file sources. No additional detection signatures or IOCs are provided.

Source articles (2)

• Fedora 44 NASM Important CVE-2026 — Linuxsecurity · 2026-06-07
  * Wed Apr 22 2026 Dominik Mierzejewski - 3.01-3 - fix CVE-2026-6067 (resolves rhbz#2458087, rhbz#2458089) patch by Nick Clifton * Wed Apr 22 2026 Dominik Mierzejewski - 3.01-3 - fix CVE-2026-6067 (res…
• Fedora 43 libssh2 Important Heap Overflow CVE-2026 — Linuxsecurity · 2026-06-07
  This update addresses CVE-2026-7598, a potential heap buffer overflow, which could be triggered remotely by supplying very long username and/or password strings. * Fri May 22 2026 Paul Howarth - 1.11.…

Timeline

• 2026-04-10 — CVE-2026-6067 published: CVE-2026-6067 disclosed, affecting NASM with potential arbitrary code execution.
• 2026-04-22 — Patch released for CVE-2026-6067: Fedora issued an update to resolve CVE-2026-6067, mitigating the arbitrary code execution risk.
• 2026-05-01 — CVE-2026-7598 published: CVE-2026-7598 published, revealing a heap buffer overflow in libssh2.
• 2026-05-22 — Patch released for CVE-2026-7598: Fedora released an update to fix CVE-2026-7598, addressing the heap overflow issue.

CVEs

• CVE-2026-6067
• CVE-2026-7598

Related entities

• Cwe-122 - Heap-based Buffer Overflow (Cwe)
• Cwe-190 - Integer Overflow Or Wraparound (Cwe)
• CWE-94 - Code Injection (Cwe)
• Fedora (Company)
• Linux (Platform)