A security vulnerability (CVE-2026-7598) exists in libssh2 up to version 1.11.1_3 in the userauth_password function of src/userauth.c. The flaw is an integer overflow caused by manipulation of username_len or password_len arguments, which can be exploited remotely. A patch fixing this issue is available in version 1.11.1_3.