DEBIAN-CVE-2026-4541
A flaw has been found in janmojzis tinyssh up to 20250501. Impacted is an unknown function of the file tinyssh/crypto_sign_ed25519_tinyssh.c of the component Ed25519 Signature Handler. This manipulation causes improper verification of cryptographic signature. The attack is restricted to local execution. The attack's complexity is rated as high. The exploitability is considered difficult. The exploit has been published and may be used. Upgrading to version 20260301 is recommended to address this issue. Patch name: 9c87269607e0d7d20174df742accc49c042cff17. Upgrading the affected component is recommended.
DEBIAN-CVE-2026-4541
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-4541
tinyssh
Source reference: /affected/0/package/name
- Affected versions
- 20250501-1
Source reference:
/affected/0/versions20250501-2Source reference:
/affected/0/versions20260301-1Source reference:
/affected/0/versions20260401-1Source reference:
/affected/0/versions20260601-1Source reference:
/affected/0/versions20260906-1Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
tinyssh
Source reference: /affected/1/package/name
- Affected versions
- 20250501-1
Source reference:
/affected/1/versions20250501-2Source reference:
/affected/1/versions - Fixed versions
- 20260301-1
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "tinyssh",
"purl": "pkg:deb/debian/tinyssh?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"20250501-1",
"20250501-2",
"20260301-1",
"20260401-1",
"20260601-1",
"20260906-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-4541.json"
},
"ecosystem_specific": {
"urgency": "unimportant"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "20260301-1"
}
]
}
],
"package": {
"name": "tinyssh",
"purl": "pkg:deb/debian/tinyssh?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"20250501-1",
"20250501-2"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-4541.json"
},
"ecosystem_specific": {
"urgency": "unimportant"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #57709 · Revision 1
- Added to Heist Feed
- Publisher date