Log in Start free

Vulnerability · Published Mar 22, 2026 · Assigned by VulDB

CVE-2026-4541janmojzis tinyssh Ed25519 Signature crypto_sign_ed25519_tinyssh.c signature verification

Low 2.5

In plain English

A low-severity insufficient verification of data authenticity in tinyssh from janmojzis. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 0% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)2.5Low
Exploit odds (30 days)<0.1%top 99.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A flaw has been found in janmojzis tinyssh up to 20250501. Impacted is an unknown function of the file tinyssh/crypto_sign_ed25519_tinyssh.c of the component Ed25519 Signature Handler. This manipulation causes improper verification of cryptographic signature. The attack is restricted to local execution. The attack's complexity is rated as high. The exploitability is considered difficult. The exploit has been published and may be used. Upgrading to version 20260301 is recommended to address this issue. Patch name: 9c87269607e0d7d20174df742accc49c042cff17. Upgrading the affected component is recommended.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13tinysshno fix listedDEBIAN-CVE-2026-4541
Debian:14tinyssh20260301-1DEBIAN-CVE-2026-4541
Ubuntu:22.04:LTStinysshno fix listedUBUNTU-CVE-2026-4541
Ubuntu:24.04:LTStinysshno fix listedUBUNTU-CVE-2026-4541
Ubuntu:25.10tinysshno fix listedUBUNTU-CVE-2026-4541
Ubuntu:26.04:LTStinysshno fix listedUBUNTU-CVE-2026-4541
Ubuntu:26.10tinysshno fix listedUBUNTU-CVE-2026-4541

Affected products (as reported)

VendorProductVersions
janmojzis tinyssh 20250501

Weakness: CWE-347, CWE-345 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C

References