The vulnerability CVE-2026-7598 affects libssh2 up to version 1.11.1 in the userauth_password function of src/userauth.c. It involves an integer overflow caused by improper handling of the username_len and password_len parameters. This flaw can be triggered remotely without requiring privileges or user interaction. The integer overflow may lead to unexpected behavior or potential security risks. A patch exists (commit 256d04b60d80bf1190e96b0ad1e91b2174d744b1) to fix this issue, but the vendor's official remediation status is not explicitly stated in the provided data.

Successful exploitation of this vulnerability could allow a remote attacker to cause an integer overflow in libssh2's user authentication process. This may result in denial of service or other unintended behavior. The CVSS score of 6.9 reflects a medium severity impact with network attack vector, no privileges required, and no user interaction needed. No evidence of active exploitation has been reported.

A patch identified by commit 256d04b60d80bf1190e96b0ad1e91b2174d744b1 is available to remediate this vulnerability. It is recommended to apply this patch or upgrade to a version of libssh2 that includes this fix. Patch status is not explicitly confirmed by a vendor advisory in the provided data; therefore, users should verify the patch availability and remediation guidance from the official libssh2 project or vendor sources.