CVE-2026-4541
janmojzis tinyssh Ed25519 Signature crypto_sign_ed25519_tinyssh.c signature verification
- State
- Published
- Severity
- 2.0 Low
- Published
- Mar 22, 2026
- Updated
- Apr 18, 2026
- Reserved
- Mar 21, 2026
Description
A flaw has been found in janmojzis tinyssh up to 20250501. Impacted is an unknown function of the file tinyssh/crypto_sign_ed25519_tinyssh.c of the component Ed25519 Signature Handler. This manipulation causes improper verification of cryptographic signature. The attack is restricted to local execution. The attack's complexity is rated as high. The exploitability is considered difficult. The exploit has been published and may be used. Upgrading to version 20260301 is recommended to address this issue. Patch name: 9c87269607e0d7d20174df742accc49c042cff17. Upgrading the affected component is recommended.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 2.0 Low | CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 2.5 Low | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C | VulDB |
| 3.0 | 2.5 Low | CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C | VulDB |
| 2.0 | 1.0 Low | AV:L/AC:H/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
tinysshjanmojzis |
|
References
- VDB-352358 | janmojzis tinyssh Ed25519 Signature crypto_sign_ed25519_tinyssh.c signature verificationvdb-entry
- VDB-352358 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- Submit #774687 | GitHub tinyssh 20250501 Cryptographic Issuesthird-party-advisory
- https://github.com/janmojzis/tinyssh/issues/101issue-tracking
- https://github.com/janmojzis/tinyssh/pull/102issue-trackingpatch
- https://github.com/janmojzis/tinyssh/issues/101#issue-3983586116exploitissue-tracking
- https://github.com/janmojzis/tinyssh/commit/9c87269607e0d7d20174df742accc49c042cff17patch
- https://github.com/janmojzis/tinyssh/releases/tag/20260301patch
- https://github.com/janmojzis/tinyssh/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.